{"id":"CVE-2026-98722","kind":"vulnerability","aliases":["CVE-2026-98722"],"related":[],"title":"Linux kernel: block2mtd divide error when erase size is zero","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: block2mtd: Fix divide error when erase_size is zero\n\nThe erase size is parsed from the \"block2mtd\" module parameter and can\nbe set to zero. add_device() then evaluates\n\n        if (size % erase_size)\n\nwith a zero divisor, which triggers a divide error:\n\ndivide error: 0000 [#1] PREEMPT SMP PTI\nRIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]\nRIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459\nCall Trace:\nblock2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476\nparam_attr_store+0x214/0x310 kernel/params.c:589\nmodule_attr_store+0x65/0x90 kernel/params.c:904\nkernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345\n...\n\nReject a zero erase size before performing the modulo operation so the\nexisting \"erasesize must be a divisor of device size\" error path\nreports the invalid argument and frees the device.","summary":"The block2mtd driver in the Linux kernel accepts a zero erase size through its module parameter and then divides by it, which crashes the kernel with a divide error. A local user who can write the block2mtd parameter can trigger a denial of service.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","self-hosted"],"not_affected_if":["block2mtd-not-loaded","default-config"],"how_to_check":"- `uname -r` and compare against the kernel version that carries the fix, which the sources do not name\n- `lsmod | grep block2mtd` to see whether the block2mtd module is loaded\n- Check whether the block2mtd module is built in or available at `/sys/module/block2mtd`","fix":"- Update to a Linux kernel build that includes the upstream fix; the sources do not give the fixed version number\n- Until updated, do not load the block2mtd module or write its parameters, as a stopgap (`modprobe -r block2mtd`)","status":"open","published_at":"2026-10-18T16:17:25+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:17:23+00:00","updated_at":"2026-10-25T05:17:23+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:17:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel build that includes the upstream fix; the sources do not give the fixed version number\n- Until updated, do not load the block2mtd module or write its parameters, as a stopgap (`modprobe -r block2mtd`)","reach":"local","title":"Linux kernel: block2mtd divide error when erase size is zero","impact":"low","summary":"The block2mtd driver in the Linux kernel accepts a zero erase size through its module parameter and then divides by it, which crashes the kernel with a divide error. A local user who can write the block2mtd parameter can trigger a denial of service.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Kernel crashes with a divide error, causing denial of service","analyst_note":"","how_to_check":"- `uname -r` and compare against the kernel version that carries the fix, which the sources do not name\n- `lsmod | grep block2mtd` to see whether the block2mtd module is loaded\n- Check whether the block2mtd module is built in or available at `/sys/module/block2mtd`","needs_analyst":false,"not_affected_if":["block2mtd-not-loaded","default-config"],"who_is_affected":"Only systems where the block2mtd driver is present and its module parameter can be written, which is normally limited to root or privileged users. Systems without block2mtd loaded or built in can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000632,"input_tokens":3633,"output_tokens":538,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':139C,147C,154C,161C,169C '-2026':12A,15A '-98722':13A,16A '0000':123C '0010':129C,136C '1':124C '296':133C '345':172C '459':142C '476':150C '589':157C '904':164C 'accept':31B 'add':104C,130C 'argument':199C 'attr':152C,159C 'block2mtd':3A,25B,60B,79C,95C,137C,145C 'call':143C 'crash':46B 'cve':11A,14A 'denial':65B 'devic':105C,131C,192C,203C 'divid':4A,42B,51B,81C,119C,121C 'divisor':115C,190C 'driver':26B 'drivers/mtd/devices/block2mtd.c':132C,141C,149C 'eras':7A,34B,84C,89C,110C,176C 'erases':186C 'error':5A,52B,82C,120C,122C,194C 'evalu':107C 'exist':185C 'fix':80C 'follow':73C 'fop':166C 'free':201C 'fs/kernfs/file.c':171C 'host':23B 'inlin':134C 'invalid':198C 'iter':168C 'kernel':2A,19B,30B,48B,71C 'kernel/params.c':156C,163C 'kernf':165C 'linux':1A,18B,29B,70C 'linux-kernel':17B 'local':54B 'modul':38B,96C,158C 'modulo':181C 'mtd':78C 'must':187C 'oper':182C 'param':151C 'paramet':39B,61B,97C 'pars':92C 'path':195C 'perform':179C 'preempt':125C 'pti':127C 'reject':173C 'report':196C 'resolv':77C 'rip':128C,135C 'runtim':20B 'self':22B 'self-host':21B 'servic':67B 'set':101C 'setup':146C 'setup2':138C 'size':8A,35B,85C,90C,109C,111C,177C,193C 'smp':126C 'store':153C,160C 'trace':144C 'trigger':63B,117C 'user':55B 'vulner':74C 'write':58B,167C 'x214/0x310':155C 'x27/0xe0':148C 'x3a4/0x540':170C 'x592/0xda0':140C 'x65/0x90':162C 'zero':10A,33B,87C,103C,114C,175C","nicknames":[],"mitigations":[],"who_affected":"Only systems where the block2mtd driver is present and its module parameter can be written, which is normally limited to root or privileged users. Systems without block2mtd loaded or built in can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98722","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98722","severity":null,"published_at":"2026-10-18T16:17:25+00:00","modified_at":"2026-10-21T13:21:40+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}