SB2026100771 - Division by zero in Linux kernel ipv4
Published: October 7, 2026
Security Bulletin ID
SB2026100771
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Division by zero (CVE-ID: CVE-2026-98299)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to division by zero in the Linux kernel functions tcp_rcvbuf_grow() and tcp_rcv_space_adjust() when processing incoming TCP data with a zero receive-queue space value. A remote attacker can send TCP data that triggers a kernel crash to cause a denial of service.
Exploitation requires tcp_rmem[1] to be configured to a very small value, such as 1.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/1c4bb940c3bb4325bb88ac1b7eaf5faaa39e7d63
- https://git.kernel.org/stable/c/60df201dbb19a1bf6478b56d100f7ae1fe90e46a
- https://git.kernel.org/stable/c/67b83c15bed9eeeb8d1a6dbf88a5f79525970173
- https://git.kernel.org/stable/c/7898bda1ebc198f5559b301a96dd5398edd4d4d3
- https://git.kernel.org/stable/c/83a945a529d6e002dd7339c532288a931f463dba
- https://git.kernel.org/stable/c/879907631b9e70eedb62d76461b29afa106ebe7a
- https://git.kernel.org/stable/c/8e32532d0fa3191ecf9524b0e6bafa0832e712ba
- https://git.kernel.org/stable/c/9a4f49bf8d2da4e52e904f60c29cca317bab9b3a