Cloudanix VulnDB

CVE-2026-98299

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux networking setting could be changed to an extremely small number, causing the computer to crash when it tries to handle normal network traffic.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Permits tcp_rmem sysctl values below 4096, allowing sk_rcvbuf initialization to 1 that truncates tcp_full_space to zero and sets rcvq_space.space to zero; subsequent calls to tcp_rcvbuf_grow or tcp_rcv_space_adjust then perform division by this zero value, triggering a kernel divide-by-zero exception.

Why it matters to the business

Linux systems can experience unexpected kernel crashes and reboots during normal network activity once tcp_rmem is set to an unsafe low value, causing service outages and requiring manual intervention to restore availability.

How an attack unfolds

An attacker with the ability to modify net.ipv4.tcp_rmem sets it to a value such as 1; when inbound TCP data later triggers dynamic receive buffer growth, the zero divisor path is executed and the kernel panics.

How to fix it

Upgrade to a kernel containing the fix that enforces a minimum of 4096 for tcp_rmem.extra1; alternatively, manually ensure net.ipv4.tcp_rmem[1] is never set below 4096 via sysctl configuration or startup scripts.

How to confirm the fix worked

Confirm sysctl net.ipv4.tcp_rmem reports values no lower than 4096; inspect kernel source or running binary for the updated extra1 bound and test that setting a sub-4096 value is rejected or clamped.

Typical attack path

  1. Obtain privileges sufficient to write sysctl net.ipv4.tcp_rmem
  2. Set tcp_rmem[1] to a value below 4096 (e.g., 1)
  3. Send or receive TCP traffic that invokes DRS and tcp_rcvbuf_grow
  4. Trigger divide-by-zero exception leading to kernel panic

How to detect it

Search kernel logs for divide error oops referencing tcp_rcvbuf_grow or tcp_input.c near line 939; correlate with preceding sysctl or /proc/sys/net/ipv4/tcp_rmem modification events.

  • divide error:.*tcp_rcvbuf_grow
  • RIP:.*tcp_rcvbuf_grow
  • tp->rcvq_space.space == 0
  • net.ipv4.tcp_rmem set to value < 4096

What your security team should do

  • Apply the corrected kernel package as soon as it is available in your distribution
  • Add monitoring or policy to prevent tcp_rmem values below 4096 in configuration management
  • Review any existing sysctl persistence files for unsafe tcp_rmem settings

The record

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcp_rmem be set below 4096 We can hit a division by zero crash in tcp_rcvbuf_grow() and tcp_rcv_space_adjust(): divide error: 0000 [#1] PREEMPT SMP RIP: 0010:tcp_rcvbuf_grow+0x187/0x450 net/ipv4/tcp_input.c:939 ... grow = div_u64(((u64)rcvwin << 1) * (newval - oldval), oldval); The division uses oldval = tp->rcvq_space.space as divisor. When tp->rcvq_space.space is zero, this leads to a divide-by-zero exception. tp->rcvq_space.space is initialized in tcp_init_buffer_space(): tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd, (u32)TCP_INIT_CWND * tp->advmss); If tcp_rmem[1] is configured to very small values (such as 1), sk->sk_rcvbuf is initialized to 1. Then tcp_full_space(sk), which computes (sk->sk_rcvbuf * scaling_ratio) >> 8, truncates to 0. This sets tp->window_clamp = 0, tp->rcv_ssthresh = 0, and tp->rcvq_space.space = 0. Later, when data arrives and DRS is invoked, tcp_rcvbuf_grow() divides by oldval == 0. Back in 2015, commit b1cb59cf2efe ("net: sysctl_net_core: check SNDBUF and RCVBUF for min length") ensured that net.core.rmem_default and net.core.rmem_max cannot be set below SOCK_MIN_RCVBUF. Similarly, SO_RCVBUF setsockopt enforces max_t(int, val * 2, SOCK_MIN_RCVBUF). However, net.ipv4.tcp_rmem still had .extra1 = SYSCTL_ONE, allowing arbitrarily small values. Because SOCK_MIN_RCVBUF depends on sizeof(struct sk_buff) and cacheline alignment, its value varies across architectures and configuration options. Using a fixed constant of 4096 ensures a predictable, architecture- independent lower bound that is safely above SOCK_MIN_RCVBUF everywhere and matches the documented 4K default. Fix this by setting tcp_rmem.extra1 to 4096 and updating the documentation.

Affected packages

Ecosystem Package Introduced Fixed