CVE-2026-31423: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31423 is a divide-by-zero vulnerability in the Linux kernel's HFSC (Hierarchical Fair Service Curve) packet scheduler (net/sched/sch_hfsc). The flaw exists in the rtsc_min() function, where the difference of two u64 values is stored in a u32 variable (dsm) and used as a divisor; when the difference equals exactly 2^32, truncation yields zero, triggering a kernel panic (divide error oops). It was published on April 13, 2026, and affects Linux kernel versions from 2.6.12 through multiple stable branches up to (but not including) fixed releases. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is a divide-by-zero (CWE-369) caused by an integer truncation bug in net/sched/sch_hfsc.c. The m2sm() function converts a u32 slope to a u64 scaled value; for large inputs (e.g., m1=4000000000), the result can reach 2^32. In rtsc_min(), the difference of two such u64 values is stored in a u32 variable dsm, which truncates the value to zero when the difference is exactly 2^32. This zero value is then used as a divisor in the concave-curve intersection path, causing a kernel oops at rtsc_min() (sch_hfsc.c:601) → init_ed() (sch_hfsc.c:629) → hfsc_enqueue() (sch_hfsc.c:1569). The fix widens dsm to u64 and replaces do_div() with div64_u64() to preserve the full 64-bit difference (GitHub Advisory, Red Hat).

Successful exploitation causes a kernel panic (divide error oops), resulting in a denial of service — the affected system becomes unstable or crashes entirely. The vulnerability has no confidentiality or integrity impact; only availability is affected (CVSS A:H). An attacker or misconfigured application with local access and the ability to enqueue packets through an HFSC qdisc with crafted slope parameters can trigger the crash, potentially affecting all services running on the host (GitHub Advisory, Red Hat).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing divide error: 0000 and RIP: 0010:rtsc_min with references to net/sched/sch_hfsc.c:601.
• Logs: Kernel call trace entries showing init_ed (net/sched/sch_hfsc.c:629) and hfsc_enqueue (net/sched/sch_hfsc.c:1569) in crash logs.
• System Behavior: Unexpected system reboots or kernel panics on hosts using HFSC traffic shaping (qdisc type hfsc).
• Network: Presence of HFSC qdisc configurations with large slope values (e.g., m1 approaching 4000000000) on network interfaces, detectable via tc qdisc show and tc class show.

Patches are available in the following fixed Linux kernel versions: 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. Distribution-specific updates have been released by Red Hat, SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Amazon Linux (ALAS2023-2026-1681, ALAS2KERNEL-5.15-2026-102), and Debian. As a workaround for systems that cannot be immediately patched, disable or avoid configuring HFSC qdisc (tc qdisc del dev <iface> root) if it is not operationally required. Monitor systems for kernel panic events related to net/sched/sch_hfsc (GitHub Advisory, Red Hat, SUSE Advisory).