GHSA-9H6M-C947-V865

Vulnerability from github – Published: 2026-10-18 18:32 – Updated: 2026-10-30 15:33
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

mtd: block2mtd: Fix divide error when erase_size is zero

The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evaluates

    if (size % erase_size)

with a zero divisor, which triggers a divide error:

divide error: 0000 [#1] PREEMPT SMP PTI RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline] RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459 Call Trace: block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476 param_attr_store+0x214/0x310 kernel/params.c:589 module_attr_store+0x65/0x90 kernel/params.c:904 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 ...

Reject a zero erase size before performing the modulo operation so the existing "erasesize must be a divisor of device size" error path reports the invalid argument and frees the device.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-98722"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-18T16:17:25Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: block2mtd: Fix divide error when erase_size is zero\n\nThe erase size is parsed from the \"block2mtd\" module parameter and can\nbe set to zero. add_device() then evaluates\n\n        if (size % erase_size)\n\nwith a zero divisor, which triggers a divide error:\n\ndivide error: 0000 [#1] PREEMPT SMP PTI\nRIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]\nRIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459\nCall Trace:\nblock2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476\nparam_attr_store+0x214/0x310 kernel/params.c:589\nmodule_attr_store+0x65/0x90 kernel/params.c:904\nkernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345\n...\n\nReject a zero erase size before performing the modulo operation so the\nexisting \"erasesize must be a divisor of device size\" error path\nreports the invalid argument and frees the device.",
  "id": "GHSA-9h6m-c947-v865",
  "modified": "2026-10-30T15:33:58Z",
  "published": "2026-10-18T18:32:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98722"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/21d0f05989bf0d5cef57b467a7fa4feefbd7236a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7ad5287e58d7aa1a848105f119e6c5b00446882f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/826170a49ca1315af6b293a02200585b1e2186d9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a991c28066e7ba4da7450bb04478849f7ac6a14a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b5965c4221165045e19736794ca5f48ae3d67142"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bff83b723e93acc788bd690dc4bc1f6f4356c35b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c8004de07739fa9a39e310e859384f1458d7d076"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fd73c079abc58e10183a4db4dc9dc5012db17476"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.