A divide‑by‑zero error was discovered in the tcf_skbedit_hash() function of the Linux kernel’s traffic‑class filter net/sched module. The bug arises when the hash‑based queue mapping range covers all 16‑bit queue IDs, causing the computed range size to wrap to zero. When the code attempts to divide by this zero value, the kernel crashes. The impact is a denial‑of‑service that brings the system down, potentially allowing an attacker to cause repeated reboots. The vulnerability does not directly expose data or elevate privileges, but the loss of availability can be very disruptive in production environments.

The flaw affects all Linux kernel releases that include the net/sched: act_skbedit implementation prior to the commit that introduced the fix (38a6f0865796). Any distribution kernel still using older source code is potentially vulnerable. The specific kernel versions are not enumerated in the advisory, so administrators should verify whether their kernel contains the fix by checking for the commit hash.

The CVSS score is 7.0, indicating a medium severity rating. EPSS data is unavailable, so exploitation probability cannot be quantified. The bug is not listed in CISA’s KEV catalog. Because the trigger requires manipulating network traffic to a device governed by the affected traffic‑class filter, the attack vector is likely local or requires network access to the target. A kernel stack manipulation by a crafted packet would induce the crash. No code‑execution or privilege‑escalation path is documented; therefore the primary risk is loss of service.