A division by zero crash occurs in tcp_rcvbuf_grow() and tcp_rcv_space_adjust() when the tcp_rmem sysctl value tcp_rmem[1] is set below 4096. The crash is triggered by an internal divisor that can become zero after a misconfigured receive buffer. This results in a kernel panic, leading to an interruption of the affected system's network services and potentially a full reboot. The weakness is a classic divide‑by‑zero error, classified as CWE‑369.

Linux kernel versions that allow tcp_rmem[1] to be set to values lower than 4096, typically before the commit that hardened this variable. The issue may affect any distribution or custom kernel that accepts user configuration of net.ipv4.tcp_rmem without enforcing a minimum of 4096 bytes. All machine architectures are impacted because the check introduced uses a fixed 4K bound rather than an architecture‑dependent min value.

The CVSS score is 7.0, and the EPSS score is lower than 1%, indicating a very low probability of exploitation. The vulnerability can be triggered by any attacker who can change sysctl values or load a kernel with a custom configuration, leading to a kernel panic and denial of service. The likely attack vector is inferred to be privileged modification of sysctl settings, as the description does not explicitly state the vector. The CWE indicates a low‑complexity, high‑impact flaw. Although it does not provide arbitrary code execution or data leakage, the kernel crash can force a system reboot or disrupt network services. This vulnerability is not currently listed in the CISA KEV catalog.