Live › vulnerability › CVE-2026-98722
Go to dashboardThe block2mtd driver in the Linux kernel accepts a zero erase size through its module parameter and then divides by it, which crashes the kernel with a divide error. A local user who can write the block2mtd parameter can trigger a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems where the block2mtd driver is present and its module parameter can be written, which is normally limited to root or privileged users. Systems without block2mtd loaded or built in can skip it.
No product ranges from the sources yet.
uname -r and compare against the kernel version that carries the fix, which the sources do not namelsmod | grep block2mtd to see whether the block2mtd module is loaded/sys/module/block2mtdmodprobe -r block2mtd)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
mtd: block2mtd: Fix divide error when erase_size is zero
The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evaluates
if (size % erase_size)
with a zero divisor, which triggers a divide error:
divide error: 0000 [#1] PREEMPT SMP PTI RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline] RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459 Call Trace: block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476 param_attr_store+0x214/0x310 kernel/params.c:589 module_attr_store+0x65/0x90 kernel/params.c:904 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 ...
Reject a zero erase size before performing the modulo operation so the existing "erasesize must be a divisor of device size" error path reports the invalid argument and frees the device.
This page as .md · .json · in your agent: get_signal("CVE-2026-98722")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.