CVE-2026-98390

Received Received - Intake

AMD Node Divide by Zero in Linux Kernel

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Avoid divide by zero on virtualized systems On a virtualized system, the number of nodes does not have a relationship to the number of roots. A Xen PVH dom0 can calculate roots_per_node as 0, which crashes with a divide by zero in: if (count++ % roots_per_node) because the underlying topology code on Xen ends up making num_nodes 2 and num_roots 1 and the integer division result is 0. The issue is seen with Xen, but it could affect other systems. Set roots_per_node to 1 in this case. Print a firmware bug when this is performed for non-virtualized systems. [ bp: Massage commit message. ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98390

EUVD

EUVD-2026-101039

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0a4b61d9c2e496b5f0a10e29e355a1465c8738bb
Linux	Linux	0a4b61d9c2e496b5f0a10e29e355a1465c8738bb
Linux	Linux	0a4b61d9c2e496b5f0a10e29e355a1465c8738bb
Linux	Linux	c4ad899a33198ab6335732c769835d035e66894a
Linux	Linux	6.17.8
Linux	Linux	6.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a divide-by-zero error in the Linux kernel's x86/amd_node code. It occurs on virtualized systems like Xen PVH dom0 where the number of nodes (2) and roots (1) leads to roots_per_node being calculated as 0. This causes a crash when the code attempts to perform modulo operation with roots_per_node.

Detection Guidance

This vulnerability specifically affects the Linux kernel on virtualized systems, particularly with Xen PVH dom0. Detection requires checking the kernel version and virtualization environment. Look for kernel logs indicating a divide-by-zero error during system boot or operation. Commands like 'dmesg | grep divide' or 'journalctl -k | grep divide' may help identify the issue.

Impact Analysis

This vulnerability can cause system crashes on affected virtualized systems running the Linux kernel. It may lead to denial of service conditions where the system becomes unresponsive or requires a reboot.

Compliance Impact

This vulnerability causes a divide-by-zero crash in the Linux kernel on virtualized systems, leading to system instability or denial of service. It does not directly impact data confidentiality, integrity, or privacy controls required by GDPR or HIPAA. Compliance risks would arise only if the crash disrupts regulated systems or services.

Mitigation Strategies

Update the Linux kernel to the patched version where roots_per_node is set to 1 in virtualized environments. For Xen PVH dom0, ensure the hypervisor and guest OS are updated. Monitor kernel logs for divide-by-zero errors post-update.

Hi! I’m here to help you understand CVE-2026-98390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70