CVE-2026-6244: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-6244 is a divide-by-zero vulnerability in the libpcap BPF (Berkeley Packet Filter) interpreter affecting the div #k and mod #k ALU instructions, which fail to validate whether the immediate operand k is zero. Discovered and disclosed on September 5, 2026, it affects libpcap versions prior to 1.10.7, maintained by The Tcpdump Group. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-369 (Divide By Zero). Within pcapint_filter_with_aux_data(), the BPF interpreter correctly rejects packets when the divisor register X is zero for div x and mod x instructions, but incorrectly assumes the immediate constant k is never zero for the div #k and mod #k variants. This assumption holds for filter programs generated or validated internally by libpcap, but not for programs supplied externally via pcap_offline_filter() or the deprecated bpf_filter() API without explicit validation. A locally privileged attacker can craft a BPF filter program with a zero immediate value and pass it through these external interfaces, triggering a division by zero that typically terminates the process via SIGFPE (libpcap commit, GitHub Advisory).

Successful exploitation results in a denial of service: the libpcap process is terminated via SIGFPE (floating-point exception signal) when the division by zero is executed. There is no impact on confidentiality or data integrity. Applications relying on libpcap for packet capture or offline filtering — such as network monitoring tools, intrusion detection systems, or traffic analyzers — could be disrupted, potentially causing gaps in network visibility (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the privilege to load a crafted BPF filter program via pcap_offline_filter() or bpf_filter() (GitHub Advisory, Feedly).

1. Identify target: Locate a system running libpcap versions prior to 1.10.7 where an application uses pcap_offline_filter() or the deprecated bpf_filter() API to process externally supplied BPF filter programs.
2. Craft malicious BPF program: Construct a BPF filter program containing a BPF_ALU|BPF_DIV|BPF_K or BPF_ALU|BPF_MOD|BPF_K instruction with the immediate value k set to zero.
3. Supply the filter: As a local user with sufficient privileges, pass the crafted BPF program to the target application via pcap_offline_filter() or bpf_filter(), bypassing libpcap's internal validation.
4. Trigger division by zero: When the BPF interpreter executes the crafted instruction, it attempts to divide by zero, causing the process to receive SIGFPE and terminate, resulting in denial of service (libpcap commit, GitHub Advisory).

• Logs: Unexpected process crash logs or core dumps from applications using libpcap (e.g., tcpdump, Wireshark, Snort, Zeek); system logs showing SIGFPE signals delivered to libpcap-based processes.
• Process: Abnormal termination of network monitoring or packet capture processes; repeated restarts of libpcap-dependent services without clear cause.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the working directory of libpcap-based applications following unexpected crashes.

Upgrade libpcap to version 1.10.7 or later, which includes the fix that adds a zero-check for the immediate value k before executing div #k and mod #k BPF instructions (libpcap commit). As a workaround prior to patching, restrict access to interfaces that accept externally supplied BPF filter programs (i.e., pcap_offline_filter() and bpf_filter()) to trusted users only. Additionally, implement input validation to reject BPF programs containing div #k or mod #k instructions with a zero immediate value before passing them to the interpreter (GitHub Advisory).