CVE-2026-43238: Linux Kernel act_skbedit DoS Vulnerability

CVE-2026-43238 Overview

CVE-2026-43238 is a divide-by-zero flaw in the Linux kernel traffic control subsystem, specifically in the tcf_skbedit_hash() function within net/sched/act_skbedit.c. The defect was introduced by commit 38a6f0865796 ("net: sched: support hash selecting tx queue"), which added SKBEDIT_F_TXQ_SKBHASH support. When a user configures a queue mapping range that covers all possible u16 queue IDs, the inclusive range size calculation overflows a 16-bit value and wraps to zero. A subsequent modulo operation against params->mapping_mod then triggers a kernel-level divide-by-zero, crashing the system.

Critical Impact
A local user with CAP_NET_ADMIN can crash the kernel by configuring an act_skbedit action with a queue mapping range spanning the full u16 space, producing a denial-of-service condition.

Affected Products

Linux kernel versions containing commit 38a6f0865796 ("net: sched: support hash selecting tx queue") prior to the fix
Distributions shipping the affected net/sched/act_skbedit module
Stable kernel branches referenced by the upstream fix commits

Discovery Timeline

2026-05-06 - CVE-2026-43238 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43238

Vulnerability Analysis

The act_skbedit traffic control action allows administrators to rewrite metadata on socket buffers, including transmit queue selection. The SKBEDIT_F_TXQ_SKBHASH flag selects an output queue based on the skb hash modulo a configured range. The range size is computed as:

mapping_mod = queue_mapping_max - queue_mapping + 1;

When queue_mapping = 0 and queue_mapping_max = U16_MAX, the inclusive range size is 65536. This value cannot fit in a u16, so the result wraps to 0 when stored in params->mapping_mod.

Later, tcf_skbedit_hash() executes:

queue_mapping += skb_get_hash(skb) % params->mapping_mod;

A modulo by zero on integer operands raises a divide error exception, which the kernel surfaces as an oops and can panic the host depending on configuration. The fix computes mapping_mod in a wider integer type and rejects ranges larger than U16_MAX, preventing the wrap-to-zero condition.

Root Cause

The root cause is an integer truncation defect combined with missing input validation. The arithmetic for the range width is performed and stored in a u16, allowing valid administrative input to silently wrap to zero. The action handler does not validate that the configured range fits within the destination type before commit.

Attack Vector

Exploitation requires local privileges sufficient to install traffic control actions, typically CAP_NET_ADMIN in the relevant network namespace. An attacker installs an act_skbedit action with SKBEDIT_F_TXQ_SKBHASH and a queue range spanning 0 to U16_MAX. When traffic traverses the action, the divide-by-zero fires inside the packet processing path, producing a kernel oops or panic and resulting in denial of service.

Verified exploit code is not available. Refer to the upstream fix commits listed in the Kernel Git Commit Log for the precise patch diff.

Detection Methods for CVE-2026-43238

Indicators of Compromise

Kernel oops or panic messages referencing tcf_skbedit_hash or divide error in dmesg and /var/log/kern.log
Unexpected reboots on hosts running custom traffic control policies
tc actions output showing skbedit entries with queue_mapping ranges spanning the full u16 space

Detection Strategies

Audit running tc configurations for skbedit actions using SKBEDIT_F_TXQ_SKBHASH with wide queue ranges
Monitor kernel ring buffer for divide_error traps originating in net/sched modules
Inventory kernel build versions across the fleet and flag hosts missing the upstream fix commits

Monitoring Recommendations

Forward kern.log and journalctl -k output to a central log platform and alert on divide-by-zero traps
Track CAP_NET_ADMIN usage and tc filter/tc actions invocations through audit subsystem rules
Correlate host crash events with prior traffic control configuration changes

How to Mitigate CVE-2026-43238

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD advisory and reboot affected systems
Restrict CAP_NET_ADMIN and unprivileged user namespace creation on multi-tenant hosts until patched
Review existing act_skbedit configurations and remove any using full-range queue_mapping values

Patch Information

The fix is distributed across multiple stable branches via the following kernel commits: 015cebdfcb97, 3c2b95b26860, 4ece5eb4836f, 59809fda4da7, 9c735a7d98c9, and be054cc66f73. Each commit computes mapping_mod in a wider type and rejects ranges larger than U16_MAX. Apply your distribution's updated kernel package once it incorporates one of these commits. See the Kernel Git Commit Log for the patch content.

Workarounds

Disable or unload the act_skbedit module on hosts that do not require it: modprobe -r act_skbedit
Constrain tc administration to trusted operators and disable kernel.unprivileged_userns_clone where supported
Validate that any deployed skbedit actions specify queue_mapping ranges narrower than the full u16 space

bash

# Configuration example
# Verify the running kernel includes the fix
uname -r

# List existing skbedit actions and inspect queue_mapping ranges
tc actions ls action skbedit

# Remove the act_skbedit module if not required
sudo modprobe -r act_skbedit

# Restrict unprivileged user namespaces (Debian/Ubuntu)
sudo sysctl -w kernel.unprivileged_userns_clone=0