Junglewise Threat Intelligence

CVE-2026-31618: Linux Kernel divide-by-zero in fbdev tdfxfb driver

CVE-2026-31618 · Severity: medium · CVSS 5.5 · Published 2026-04-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's display driver component could allow a local user to crash the system. The issue occurs when the system processes specific display configuration requests, leading to a 'divide-by-zero' error. This results in a denial-of-service, potentially disrupting operations or causing data loss for unsaved work.

Technical details

A divide-by-zero vulnerability exists in the Linux kernel's fbdev subsystem, specifically within the tdfxfb and udlfb drivers. The root cause is the lack of validation for the 'pixclock' value in the fb_var_screeninfo structure when processing the FBIOPUT_VSCREENINFO ioctl. A local attacker with sufficient privileges to access the framebuffer device can provide a zero value for pixclock, triggering a kernel panic. The vulnerability has been addressed by adding a check to ensure pixclock is non-zero in tdfxfb_check_var. Patches are available across multiple stable kernel branches including 6.6.y, 6.12.y, 6.19.y, and 7.0.y.

Affected products

  • Linux Linux Kernel versions from 2.6.12.1 up to (excluding) 6.6.136; 6.7 up to (excluding) 6.12.83; 6.13 up to (excluding) 6.18.24; 6.19 up to (excluding) 6.19.14; 7.0 up to (excluding) 7.0.1

Timeline

  • 2026-04-24: disclosed
  • 2026-04-24: advisory
  • 2026-04-22: patched: Initial patches applied to stable branches.

References