CVE-2026-98722
Received Received - Intake

Divide Error in Linux Kernel MTD block2mtd

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erase_size is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evaluates if (size % erase_size) with a zero divisor, which triggers a divide error: divide error: 0000 [#1] PREEMPT SMP PTI RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline] RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459 Call Trace: block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476 param_attr_store+0x214/0x310 kernel/params.c:589 module_attr_store+0x65/0x90 kernel/params.c:904 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 ... Reject a zero erase size before performing the modulo operation so the existing "erasesize must be a divisor of device size" error path reports the invalid argument and frees the device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98722
EUVD
EUVD-2026-103976

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux ea6d833a3fddcd1d60414d48f34c7f4fbe88608f
Linux Linux ea6d833a3fddcd1d60414d48f34c7f4fbe88608f
Linux Linux ea6d833a3fddcd1d60414d48f34c7f4fbe88608f
Linux Linux ea6d833a3fddcd1d60414d48f34c7f4fbe88608f
Linux Linux 3.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs in the block2mtd driver when the erase_size parameter is set to zero. The code attempts to perform a division operation using this zero value as a divisor, causing a divide error that crashes the system.

Detection Guidance

This vulnerability can be detected by checking if the block2mtd module is loaded with a zero erase_size parameter. Inspect kernel logs for divide error messages or check module parameters using commands like 'dmesg | grep divide error' or 'cat /sys/module/block2mtd/parameters/erase_size'.

Impact Analysis

This vulnerability can cause a kernel crash (divide error) when the block2mtd module is configured with an erase_size of zero. This leads to a denial of service as the system becomes unresponsive or reboots.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a divide-by-zero error in the Linux kernel's mtd block2mtd module that causes a system crash. Compliance impacts would only occur if the crash leads to data loss or system unavailability, which is not specified in the provided context.

Mitigation Strategies

Immediately unload the block2mtd module if loaded with a zero erase_size parameter using 'rmmod block2mtd'. Ensure the erase_size parameter is set to a non-zero value before loading the module. Update the Linux kernel to a patched version where this issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98722. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart