CVE-2026-31423

The flaw lies in the Linux kernel traffic scheduler module, where a division by zero occurs in the rtsc_min() function of the HFSC scheduler. When a particular calculation yields a divisor of zero due to integer truncation, the kernel raises an oops exception that forces a crash. This results in a denial of service, preventing the kernel or affected processes from continuing until a reboot or restart.

The vulnerability is present in any Linux kernel that implements the HFSC fair scheduling algorithm. The advisory does not specify which kernel releases are affected, so all builds containing the current sch_hfsc implementation may be vulnerable until a patched release is applied.

The CVSS score of 5.5 indicates a moderate severity. The issue is not listed in the CISA KEV catalog and no EPSS score is available. Exploitation would require triggering the HFSC scheduler with crafted traffic, implying a local or privileged access requirement. The precise attack vector is not detailed, but an attacker that can cause the scheduler to process malicious packets can induce a kernel crash and temporary denial of service.