SB20261029200 - Division by zero in Linux kernel ipv4

Description

This security bulletin contains information about 1 vulnerability.

1) Division by zero (CVE-ID: CVE-2026-99121)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to division by zero in the Linux kernel's fib_rebalance() function when a concurrent change to ignore_routes_with_linkdown causes inconsistent nexthop eligibility between its two passes. A local privileged user can trigger rebalancing during such a change to cause a division-by-zero fault that may crash the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5046d2880fec7d49ebed2fd2866747ee1d06ad71
• https://git.kernel.org/stable/c/5dac5c7ba8f5f3fb4bf29f2a2c3cb552f5b83c8f
• https://git.kernel.org/stable/c/d5520e815c4b1427104ce1428ee23821f2aa824d