Executive brief
A vulnerability in the Linux kernel's RIVA graphics driver could allow a local user to crash the system. The issue occurs when the driver processes specific display configuration requests without properly validating hardware timing data. An attacker could exploit this by using a specially crafted or emulated device to trigger a kernel crash, leading to a complete denial of service.
Technical details
A divide-by-zero vulnerability exists in the rivafb driver within the Linux kernel's fbdev subsystem. The flaw is located in the nv3_arb() function in drivers/video/fbdev/riva/riva_hw.c, which fails to validate the state->mclk_khz value before using it as a divisor. A local attacker can trigger this code path via the FBIOPUT_VSCREENINFO ioctl on a /dev/fb* device. While typically provided by hardware, an attacker using a malicious or emulated PCI device can force this value to zero, resulting in a kernel 'divide error' and immediate system crash. Patches have been released across multiple stable kernel branches to check for zero values before performing the division.
Affected products
- Linux Linux Kernel up to 5.10.251, 5.11 to 5.15.201, 5.16 to 6.1.164, 6.2 to 6.6.127, 6.7 to 6.12.74, 6.13 to 6.18.13, 6.19 to 6.19.3
Timeline
- 2025-12-07: other: Patch authored
- 2026-02-14: patched: Patch committed to stable tree
- 2026-03-18: advisory: CVE published
References
- https://git.kernel.org/stable/c/0209e21e3c372fa2da04c39214bec0b64e4eb5f4
- https://git.kernel.org/stable/c/3e4cbd1d46c246dfa684c8e9d8c20ae0b960c50a
- https://git.kernel.org/stable/c/526460a96c5443e2fc0fd231edd1f9c49d2de26b
- https://git.kernel.org/stable/c/52916878db2b8e3769743a94484729f0844352df
- https://git.kernel.org/stable/c/73f0391e92d404da68f7484e57c106c5e673dc7e
- https://git.kernel.org/stable/c/78daf5984d96edec3b920c72a93bd6821b8710b7
- https://git.kernel.org/stable/c/9efa0dc46270a8723c158c64afbcf1dead72b28c