{"id":"CVE-2026-98919","kind":"vulnerability","aliases":["CVE-2026-98919"],"related":[],"title":"Linux kernel: Intel Xe GPU driver idle-delay setup can divide by zero and panic","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: harden adjust_idledly() against divide-by-zero and overflow\n\nadjust_idledly() has several corner-case issues flagged during review:\n\n  1. If xe_gt_clock_init() failed to recognise the crystal clock,\n     gt->info.timestamp_base is 0, which makes idledly_units_ps also 0.\n     The subsequent DIV_ROUND_CLOSEST(..., idledly_units_ps) is then a\n     divide-by-zero and panics the kernel.\n\n  2. The tick-to-ns conversions are done in u32:\n        idledly * idledly_units_ps, (maxcnt - 1) * 1000\n     Both overflow u32 before DIV_ROUND_CLOSEST() sees them.\n\n  3. If IDLE_WAIT_TIME reads back as 0, maxcnt evaluates to 0 and\n     the maxcnt - 1 clamp wraps to 0xFFFFFFFF in u32.\n\n  4. The register only stores whole ticks, so the clamped ns value has\n     to be converted to ticks and back. DIV_ROUND_CLOSEST() can round\n     that conversion up past maxcnt:\n\n       maxcnt = 640 ns, one tick = 666664 ps\n\n       clamp:        maxcnt - 1        = 639 ns\n       ns -> ticks:  639000 / 666664   = 0.958 -> rounds to 1 tick\n       tick -> ns:    1 * 666664 / 1000 = 667 ns\n\n     667 ns is programmed into RING_IDLEDLY, but 667 >= maxcnt (640),\n     so xe_gt_WARN_ON() fires again on every subsequent init.\n\nReturn early if timestamp_base is 0 (the unknown-crystal path).\nDo the conversions in u64 via the *_ULL() helpers so they cannot wrap.\nClamp with a floor (DIV_ROUND_DOWN_ULL) so the programmed delay stays\nstrictly below maxcnt, and guard the maxcnt == 0 case with a zero delay\nwhile still writing RING_IDLEDLY so INHIBIT_SWITCH_UNTIL_PREEMPTED is\ncleared.\n\nv2: Drop the redundant warn on the timestamp_base == 0 path;\n    xe_gt_clock_init() already warns on an unrecognised crystal clock.\n    Keep the early return to avoid the divide-by-zero. - Vinay\n\nv3: Field-mask the RING_IDLEDLY write with REG_FIELD_PREP(IDLE_DELAY, ...)\n    instead of writing the raw tick count, which could clobber\n    INHIBIT_SWITCH_UNTIL_PREEMPTED and reserved bits. Split the\n    inhibit-switch clear from the maxcnt clamp so a set inhibit bit no\n    longer forces a needless delay overwrite when the delay itself is\n    already valid. Use gt_to_xe(gt) instead of gt_to_xe(hwe->gt).\n\n(cherry picked from commit d864065ea25e9d12897c175de9176ce46677e176)","summary":"The Intel Xe graphics driver in the Linux kernel could divide by zero or overflow while computing the GPU idle delay when the crystal clock is not recognised, which panics the kernel. The sources do not describe an attacker-controlled trigger, so the impact is a kernel crash during driver initialisation on affected hardware.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drm","infrastructure","intel-xe","kernel","linux","self-hosted"],"not_affected_if":["no-intel-xe-driver","non-intel-gpu"],"how_to_check":"- Check whether the kernel includes the Xe driver: `grep -i xe /proc/modules` or `lsmod | grep xe` on a system with Intel Arc or recent Intel integrated graphics.\n- Compare the running kernel to the fixed commit d864065ea25e9d12897c175de9176ce46677e176 in the stable kernel branch for your release.","fix":"- Update the Linux kernel to a stable release that contains commit d864065ea25e9d12897c175de9176ce46677e176 (version unknown from the sources).\n- Until patched, unknown.","status":"open","published_at":"2026-10-23T13:17:12+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:24+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:58:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that contains commit d864065ea25e9d12897c175de9176ce46677e176 (version unknown from the sources).\n- Until patched, unknown.","reach":"local","title":"Linux kernel: Intel Xe GPU driver idle-delay setup can divide by zero and panic","impact":"low","summary":"The Intel Xe graphics driver in the Linux kernel could divide by zero or overflow while computing the GPU idle delay when the crystal clock is not recognised, which panics the kernel. The sources do not describe an attacker-controlled trigger, so the impact is a kernel crash during driver initialisation on affected hardware.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","intel-xe","drm","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Kernel panic during GPU driver initialisation, causing a system crash","analyst_note":"Find the affected kernel version range and stable fix release for commit d864065ea25e9d12897c175de9176ce46677e176 at the NVD page or the upstream kernel git log.","how_to_check":"- Check whether the kernel includes the Xe driver: `grep -i xe /proc/modules` or `lsmod | grep xe` on a system with Intel Arc or recent Intel integrated graphics.\n- Compare the running kernel to the fixed commit d864065ea25e9d12897c175de9176ce46677e176 in the stable kernel branch for your release.","needs_analyst":true,"not_affected_if":["no-intel-xe-driver","non-intel-gpu"],"who_is_affected":"Systems running a Linux kernel with the Intel Xe DRM driver, mainly machines with Intel Arc discrete GPUs or newer Intel integrated graphics. The sources do not say which kernel versions are affected, and the flaw is triggered during driver setup rather than by remote input. Systems without the Xe driver, such as those using other GPUs, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000794,"input_tokens":4279,"output_tokens":732,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-98919':19A,22A '0':136C,143C,198C,202C,299C,338C,365C '0.958':259C '0xffffffff':210C '1':120C,179C,206C,252C,262C,266C '1000':180C,268C '2':163C '3':190C '4':213C '639':253C '639000':257C '640':244C,281C '666664':248C,258C,267C '667':269C,271C,279C 'adjust':100C,109C 'affect':86B 'alreadi':371C,448C 'also':142C 'attack':72B 'attacker-control':71B 'avoid':383C 'back':196C,232C 'base':134C,297C,364C 'bit':420C,435C 'cannot':316C 'case':115C,339C 'cherri':462C 'clamp':207C,222C,250C,318C,430C 'clear':355C,426C 'clobber':413C 'clock':57B,124C,131C,369C,377C 'closest':148C,187C,235C 'commit':465C 'comput':49B 'control':73B 'convers':169C,239C,307C 'convert':228C 'corner':114C 'corner-cas':113C 'could':42B,412C 'count':410C 'crash':81B 'crystal':56B,130C,303C,376C 'cve':17A,20A 'd864065ea25e9d12897c175de9176ce46677e176':466C 'delay':9A,53B,329C,343C,403C,441C,445C 'describ':69B 'div':146C,185C,233C,322C 'divid':12A,43B,104C,156C,386C 'divide-by-zero':103C,155C,385C 'done':171C 'driver':6A,37B,83B 'drm':23B 'drm/xe':98C 'drop':357C 'earli':294C,380C 'evalu':200C 'everi':290C 'fail':126C 'field':392C,400C 'field-mask':391C 'fire':287C 'flag':117C 'floor':321C 'follow':93C 'forc':438C 'gpu':5A,51B 'graphic':36B 'gt':123C,132C,284C,368C,451C,454C,457C,461C 'guard':335C 'harden':99C 'hardwar':87B 'helper':313C 'host':32B 'hwe':460C 'idl':8A,52B,101C,110C,139C,149C,174C,175C,192C,277C,348C,396C,402C 'idle-delay':7A 'impact':77B 'info.timestamp':133C 'infrastructur':24B 'inhibit':350C,414C,424C,434C 'inhibit-switch':423C 'init':125C,292C,370C 'initialis':84B 'instead':404C,455C 'intel':3A,26B,34B 'intel-x':25B 'issu':116C 'keep':378C 'kernel':2A,28B,41B,64B,80B,91C,162C 'linux':1A,29B,40B,90C 'longer':437C 'make':138C 'mask':393C 'maxcnt':178C,199C,205C,242C,243C,251C,280C,333C,337C,429C 'needless':440C 'ns':168C,223C,245C,254C,255C,265C,270C,272C 'one':246C 'overflow':47B,108C,182C 'overwrit':442C 'panic':16A,62B,160C 'past':241C 'path':304C,366C 'pick':463C 'preempt':353C,417C 'prep':401C 'program':274C,328C 'ps':141C,151C,177C,249C 'raw':408C 'read':195C 'recognis':60B,128C 'redund':359C 'reg':399C 'regist':215C 'reserv':419C 'resolv':97C 'return':293C,381C 'review':119C 'ring':276C,347C,395C 'round':147C,186C,234C,237C,260C,323C 'see':188C 'self':31B 'self-host':30B 'set':433C 'setup':10A 'sever':112C 'sourc':66B 'split':421C 'stay':330C 'still':345C 'store':217C 'strict':331C 'subsequ':145C,291C 'switch':351C,415C,425C 'tick':166C,219C,230C,247C,256C,263C,264C,409C 'tick-to-n':165C 'time':194C 'timestamp':296C,363C 'trigger':74B 'u32':173C,183C,212C 'u64':309C 'ull':312C,325C 'unit':140C,150C,176C 'unknown':302C 'unknown-cryst':301C 'unrecognis':375C 'use':450C 'v2':356C 'v3':390C 'valid':449C 'valu':224C 'via':310C 'vinay':389C 'vulner':94C 'wait':193C 'warn':285C,360C,372C 'whole':218C 'wrap':208C,317C 'write':346C,397C,406C 'xe':4A,27B,35B,122C,283C,367C,453C,459C 'zero':14A,45B,106C,158C,342C,388C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the Intel Xe DRM driver, mainly machines with Intel Arc discrete GPUs or newer Intel integrated graphics. The sources do not say which kernel versions are affected, and the flaw is triggered during driver setup rather than by remote input. Systems without the Xe driver, such as those using other GPUs, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98919","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98919","severity":null,"published_at":"2026-10-23T13:17:12+00:00","modified_at":"2026-10-23T13:17:12+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98919","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98919","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}