Linux Kernel BFQ I/O Scheduler Division by Zero Vulnerability

A division by zero vulnerability has been identified in the Linux kernel's BFQ (Budget Fair Queueing) I/O scheduler. This issue occurs when the weighted sum of I/O requests is zero, leading to a calculation error in the scheduling limit. The vulnerability was discovered using the 'stress-ng' tool with I/O priority manipulation, which triggered the error in a controlled environment.

Impact

Exploitation of this vulnerability causes a division by zero error, leading to a kernel panic or crash.

Reproduction

The vulnerability can be reproduced by running the 'stress-ng' tool as the root user, with the I/O priority option set to zero. This combination triggers the division by zero error in the BFQ I/O scheduler.

Remediation

Users can upgrade to the patched version of the Linux kernel where this vulnerability has been addressed.