Junglewise Threat Intelligence

CVE-2026-23266: Linux Kernel rivafb divide error in nv3_arb

CVE-2026-23266 · Severity: medium · CVSS 5.5 · Published 2026-03-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's RIVA graphics driver could allow a local user to crash the system. The issue occurs when the driver processes specific display configuration requests without properly validating hardware timing data. An attacker could exploit this by using a specially crafted or emulated device to trigger a kernel crash, leading to a complete denial of service.

Technical details

A divide-by-zero vulnerability exists in the rivafb driver within the Linux kernel's fbdev subsystem. The flaw is located in the nv3_arb() function in drivers/video/fbdev/riva/riva_hw.c, which fails to validate the state->mclk_khz value before using it as a divisor. A local attacker can trigger this code path via the FBIOPUT_VSCREENINFO ioctl on a /dev/fb* device. While typically provided by hardware, an attacker using a malicious or emulated PCI device can force this value to zero, resulting in a kernel 'divide error' and immediate system crash. Patches have been released across multiple stable kernel branches to check for zero values before performing the division.

Affected products

  • Linux Linux Kernel up to 5.10.251, 5.11 to 5.15.201, 5.16 to 6.1.164, 6.2 to 6.6.127, 6.7 to 6.12.74, 6.13 to 6.18.13, 6.19 to 6.19.3

Timeline

  • 2025-12-07: other: Patch authored
  • 2026-02-14: patched: Patch committed to stable tree
  • 2026-03-18: advisory: CVE published

References