CVE-2026-23266
Divide-by-Zero Vulnerability in Linux rivafb Driver Causes Kernel Crash
Publication date: 2026-03-18
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.18.0-rc1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's rivafb driver, specifically in the nv3_arb() function. A userspace program can trigger the RIVA NV3 arbitration code by calling the FBIOPUT_VSCREENINFO ioctl on /dev/fb*. The driver recalculates FIFO arbitration parameters using a value called state->mclk_khz as a divisor without validating it first.
Normally, state->mclk_khz is provided by real hardware and is non-zero. However, an attacker can create a malicious or misconfigured device that exposes a bogus PLL configuration, causing state->mclk_khz to be zero. When the driver attempts to divide by this zero value, it causes a divide error that crashes the kernel.
The vulnerability is fixed by adding a check to ensure state->mclk_khz is not zero before performing the division, preventing the kernel crash.
How can this vulnerability impact me? :
This vulnerability can be exploited by a userspace program to crash the Linux kernel, causing a denial of service (DoS) condition. By triggering a divide-by-zero error in the rivafb driver, an attacker can cause the system to become unstable or unresponsive.
If an attacker has the ability to provide a crafted or emulated PCI device or otherwise manipulate the framebuffer device, they can exploit this flaw to disrupt system operations.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel logs for a specific divide error related to the rivafb driver when the FBIOPUT_VSCREENINFO ioctl is called on /dev/fb* devices.
A typical log message indicating this issue includes lines such as:
- rivafb: setting virtual Y resolution to 2184
- divide error: 0000 [#1] PREEMPT SMP KASAN PTI
- RIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439
To detect this on your system, you can check the kernel ring buffer or system logs using commands like:
- dmesg | grep rivafb
- journalctl -k | grep rivafb
- journalctl -k | grep 'divide error'
Additionally, monitoring for crashes or kernel panics related to /dev/fb* ioctl calls may help identify attempts to trigger this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Linux kernel to a version where this vulnerability has been fixed.
The fix involves validating the state->mclk_khz value before performing division in the nv3_arb() function to prevent divide errors and kernel crashes.
Until the kernel is updated, avoid running or allowing userspace programs to call the FBIOPUT_VSCREENINFO ioctl on /dev/fb* devices, especially if the system uses the rivafb driver.
If possible, restrict access to /dev/fb* devices to trusted users only.