CVE-2026-23379 in Linux
Riassunto
di VulDB • 15/06/2026
Based on the kernel panic trace and the specific instruction to fix the issue by using 64-bit integers for `q_sum` and `q_psum`, this is a classic integer overflow bug in the Linux kernel's ETS (Enhanced Transmission Selective) qdisc implementation.
### Problem Analysis The crash occurs in `ets_offload_change` within the `sch_ets` module. The ETS qdisc calculates bandwidth shares for classes. If the sum of bandwidth shares (`q_sum`) or partial sums (`q_psum`) exceeds the range of a 32-bit signed integer (`int`), it causes an overflow. This leads to incorrect calculations, potentially negative values or wrap-around, which then causes a fault when used in subsequent arithmetic or memory operations (as seen in the RIP instruction `41 f7 f2` which is `test $0x0,%r10d` or similar division/modulus operations that can fault on bad inputs).
### Solution We need to change the data types of `q_sum` and `q_psum` from `int` (32-bit) to `u64` or `long long` (64-bit) to prevent overflow when summing bandwidth shares.
Here is the fix applied to the relevant code in `net/sched/sch_ets.c`:
```c // In net/sched/sch_ets.c, inside the ets_offload_change function or related helper
// BEFORE (problematic): // int q_sum = 0, q_psum = 0;
// AFTER (fixed): u64 q_sum = 0, q_psum = 0; ```
Additionally, ensure that any intermediate calculations involving these variables are also performed using 64-bit arithmetic. For example, if you are adding bandwidth shares:
```c // Ensure bandwidth shares are cast to u64 before addition q_sum += (u64)q->bands[i].bw_share;
q_psum += (u64)q->bands[i].bw_share;
```
### Why This Fixes the Issue 1. **Overflow Prevention**: Bandwidth shares can be large, especially in high-speed networks or when many classes are configured. A 32-bit `int` can only hold up to ~2 billion. If the total share exceeds this, it overflows. Using `u64` (up to ~18 quintillion) prevents this. 2. **Correct Arithmetic**: The ETS algorithm relies on precise ratios. Overflow corrupts these ratios, leading to invalid state that triggers the kernel panic.
### Verification After applying this change, recompile the kernel module and test with a configuration that previously triggered the panic (e.g., many ETS classes with high bandwidth shares). The panic should no longer occur.
If you want to get best quality of vulnerability data, you may have to visit VulDB.