A divide‑by‑zero error in the nfnetlink_osf module occurs when nf_osf_match_one() calculates ctx->window % f->wss.val without first verifying that f->wss.val is non‑zero. A user with CAP_NET_ADMIN can add a fingerprint that causes this calculation and triggers a kernel panic on the next matching TCP SYN. This results in a system‑wide denial of service. The weakness is a classic divide‑by‑zero error leading to unintended crash.

All Linux kernel builds that include the nfnetlink_osf implementation and have not yet incorporated the patch introducing a guard against zero‑modulus values. The affected code lives in net/netfilter/nfnetlink_osf.c and is part of the core kernel, so any distribution kernel containing that source file is susceptible.

The CVSS score is not provided, but the vulnerability leads to a kernel crash, making it a severe denial of service. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires CAP_NET_ADMIN, which is typically only present for privileged users or services. Therefore the risk is high for systems where local or remote privilege escalation is possible, and moderate otherwise. A patch is the most effective mitigation.