CVE-2026-98299

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: do not let tcp_rmem be set below 4096

We can hit a division by zero crash in tcp_rcvbuf_grow()

and tcp_rcv_space_adjust():

divide error: 0000 [#1] PREEMPT SMP

RIP: 0010:tcp_rcvbuf_grow+0x187/0x450 net/ipv4/tcp_input.c:939

...

grow = div_u64(((u64)rcvwin << 1) * (newval - oldval), oldval);

The division uses oldval = tp->rcvq_space.space as divisor.

When tp->rcvq_space.space is zero, this leads to a divide-by-zero

exception.

tp->rcvq_space.space is initialized in tcp_init_buffer_space():

tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd,

(u32)TCP_INIT_CWND * tp->advmss);

If tcp_rmem[1] is configured to very small values (such as 1),

sk->sk_rcvbuf is initialized to 1. Then tcp_full_space(sk), which

computes (sk->sk_rcvbuf * scaling_ratio) >> 8, truncates to 0.

This sets tp->window_clamp = 0, tp->rcv_ssthresh = 0, and

tp->rcvq_space.space = 0. Later, when data arrives

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References