Executive brief
The Linux kernel's ASPEED G6 PWM/fan tachometer driver contains a divide-by-zero vulnerability in its fan speed calculation logic. If the hardware reports a tachometer value of zero due to a glitch or signal anomaly, the driver crashes with a kernel panic, causing system unavailability. This affects server platforms and embedded systems that use ASPEED BMC controllers for hardware monitoring.
Technical details
The vulnerability is a divide-by-zero error in the aspeed_tach_val_to_rpm() function within drivers/hwmon/aspeed-g6-pwm-tach.c. The function calculates fan RPM by dividing the clock rate by a tachometer divisor (tach_div) without first validating that tach_div is non-zero. When the hardware reports a tachometer value of zero (due to an extremely fast pulse, stuck edge, or hardware glitch), tach_div evaluates to zero, and the subsequent do_div() call triggers a divide-by-zero exception. The fix adds an explicit check: if tach_div is zero, the function returns 0 RPM instead of attempting the division. This is a low-impact DoS vector accessible only to local code or hardware with privileged access to the tachometer interface.
Affected products
- Linux Linux kernel versions prior to the fix commit (fc7b8dc67f1b2c64e76a66e78468c533d3c44ca)
Timeline
- 2026-08-15: disclosed
- 2026-06-29: patched: Fix commit authored by Guenter Roeck
- 2026-07-24: other: Patch merged to stable kernel tree by Greg Kroah-Hartman