CVE-2026-31770
Division by Zero in Linux Kernel hwmon OCC Driver
Publication date: 2026-05-01
Last updated on: 2026-05-11
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.203 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.22 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.168 (exc) |
| linux | linux_kernel | From 5.0 (inc) to 5.10.253 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.12 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.81 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.134 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-369 | The product divides a value by zero. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's hardware monitoring (hwmon) subsystem, specifically in the function occ_show_power_1(). The issue is a division by zero error that occurs because the code divides an accumulator by a variable called update_tag without checking if update_tag is zero.
If no sensor samples have been collected yet, such as during early boot when the sensor block is included but not updated, update_tag is zero. This causes the kernel to crash due to a divide-by-zero error.
A previous fix in 2019 addressed a similar issue in related functions but missed this particular code path. The fix involves reusing an existing helper function that properly handles the zero-sample case and performs multiplication before division to avoid this error.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash unexpectedly due to a division by zero error in the hardware monitoring subsystem.
Such a kernel crash can lead to system instability, unexpected reboots, or downtime, which may affect the availability and reliability of systems running vulnerable Linux kernel versions.