CVE-2026-23379 in Linux
Zusammenfassung
von VulDB • 30.05.2026
Based on the kernel panic trace and the specific instruction to fix the issue by using 64-bit integers for `q_sum` and `q_psum`, this appears to be an integer overflow or type mismatch issue in the `ets_offload_change` function within the `sch_ets` (Enhanced Transmission Selection) scheduler module.
The crash occurs in `ets_offload_change+0x11f`, likely due to arithmetic operations on 32-bit variables that exceed their capacity, leading to invalid memory access or corrupted state. The fix involves changing the data types of `q_sum` and `q_psum` from 32-bit (`u32` or `int`) to 64-bit (`u64`).
Here is the corrected code snippet for the relevant part of `net/sched/sch_ets.c`:
### Fix Description
In the `ets_offload_change` function, locate the variables `q_sum` and `q_psum`. Change their type from `u32` (or `int`) to `u64`.
### Code Patch
```c // In net/sched/sch_ets.c
// Before (problematic): // u32 q_sum, q_psum;
// After (fixed): u64 q_sum, q_psum; ```
### Detailed Explanation
1. **Root Cause**: The `ets_offload_change` function calculates sums of quantum values (`q_sum`) and priority sums (`q_psum`). If these sums exceed the maximum value of a 32-bit unsigned integer (4,294,967,295), they overflow. This can lead to incorrect calculations, negative values when interpreted as signed, or invalid pointers/indices if these values are used in subsequent arithmetic or array indexing, causing a kernel panic.
2. **Why 64-bit?**: Using `u64` ensures that the sums can accommodate larger values without overflow, which is critical for systems with many queues or large quantum values.
3. **Additional Considerations**: - Ensure that any arithmetic operations involving `q_sum` and `q_psum` are also performed using 64-bit arithmetic. - If these values are passed to hardware offload functions, verify that the hardware/driver supports 64-bit values. If not, you may need to clamp the values or handle them differently. - Check for any other variables in the same function that might also be prone to overflow and should be upgraded to 64-bit.
### Example Context (Hypothetical)
```c static int ets_offload_change(struct Qdisc *sch, struct netlink_ext_ack *extack) {
struct ets_sched *q = qdisc_priv(sch); u64 q_sum = 0; // Changed from u32 u64 q_psum = 0; // Changed from u32 int i;
// ... rest of the function ...
for (i = 0; i < ETS_MAX_QUEUES; i++) {
if (q->prio[i].enabled) {
q_sum += q->prio[i].quantum;
q_psum += q->prio[i].priority;
} }
// ... rest of the function ... } ```
This change should resolve the integer overflow issue and prevent the kernel panic in `ets_offload_change`.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.