---
id: "CVE-2026-98722"
kind: "vulnerability"
aliases: ["CVE-2026-98722"]
title: "Linux kernel: block2mtd divide error when erase size is zero"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "runtime", "self-hosted"]
not_affected_if: ["block2mtd-not-loaded", "default-config"]
published_at: "2026-10-18T16:17:25+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:17:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98722", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: block2mtd divide error when erase size is zero

The block2mtd driver in the Linux kernel accepts a zero erase size through its module parameter and then divides by it, which crashes the kernel with a divide error. A local user who can write the block2mtd parameter can trigger a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the kernel version that carries the fix, which the sources do not name
- `lsmod | grep block2mtd` to see whether the block2mtd module is loaded
- Check whether the block2mtd module is built in or available at `/sys/module/block2mtd`

## Fix

- Update to a Linux kernel build that includes the upstream fix; the sources do not give the fixed version number
- Until updated, do not load the block2mtd module or write its parameters, as a stopgap (`modprobe -r block2mtd`)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98722

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

mtd: block2mtd: Fix divide error when erase_size is zero

The erase size is parsed from the "block2mtd" module parameter and can
be set to zero. add_device() then evaluates

        if (size % erase_size)

with a zero divisor, which triggers a divide error:

divide error: 0000 [#1] PREEMPT SMP PTI
RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
Call Trace:
block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
param_attr_store+0x214/0x310 kernel/params.c:589
module_attr_store+0x65/0x90 kernel/params.c:904
kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
...

Reject a zero erase size before performing the modulo operation so the
existing "erasesize must be a divisor of device size" error path
reports the invalid argument and frees the device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_