Skip to main content

Linux Kernel CVE-2026-31603

| EUVDEUVD-2026-25496 MEDIUM
Divide By Zero (CWE-369)
2026-04-24 Linux GHSA-rfh9-x593-fmpr
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local framebuffer device access requires PR:L; divide-by-zero causes kernel panic (A:H); no data exposure or integrity impact justifies C:N/I:N.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:55 vuln.today
CVSS changed
Apr 29, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch released
Apr 29, 2026 - 19:07 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25496
CVE Published
Apr 24, 2026 - 14:42 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

staging: sm750fb: fix division by zero in ps_to_hz()

ps_to_hz() is called from hw_sm750_crtc_set_mode() without validating that pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO causes a division by zero.

Fix by rejecting zero pixclock in lynxfb_ops_check_var(), consistent with other framebuffer drivers.

AnalysisAI

Division-by-zero in the sm750fb staging framebuffer driver allows a local low-privileged user to crash the kernel. By submitting a FBIOPUT_VSCREENINFO ioctl with pixclock set to zero, an attacker triggers an unvalidated division in ps_to_hz(), called from hw_sm750_crtc_set_mode(), resulting in a kernel panic and full denial of service. No public exploit code has been identified and EPSS is 0.02% (5th percentile), consistent with a locally-reachable, hardware-dependent crash with no remote or confidentiality impact.

Technical ContextAI

The sm750fb driver (drivers/staging/sm750fb/) is a staging-quality framebuffer driver for Silicon Motion SM750 GPU hardware. The function ps_to_hz() converts a pixclock period expressed in picoseconds to a frequency in Hz by performing an integer division - when pixclock is zero this produces a divide-by-zero fault at the kernel level. The call path hw_sm750_crtc_set_mode() → ps_to_hz() lacked any input sanitization before invoking the division. The fix adds a zero-pixclock rejection guard in lynxfb_ops_check_var(), following the pattern used by other mainline framebuffer drivers. CWE-369 (Divide By Zero) describes this root cause class: unchecked divisor inputs in arithmetic operations leading to undefined behavior or crashes. CPE cpe:2.3:a:linux:linux confirms this affects the Linux kernel software broadly, but exploitation is constrained to hosts with SM750 hardware and the staging driver loaded.

RemediationAI

Upgrade to a patched Linux kernel release: 6.12.83, 6.18.24, 6.19.14, or 7.0.1, per EUVD-confirmed fix versions. Upstream stable commits are available at the kernel.org references provided. Ubuntu users should apply the update detailed in USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1). As a compensating control where immediate kernel upgrade is not feasible, restrict access to framebuffer devices (e.g., remove non-root users from the 'video' group and tighten /dev/fb* permissions to root-only) to prevent unprivileged users from issuing FBIOPUT_VSCREENINFO ioctls - this removes the PR:L exploitation path. Alternatively, blacklisting the sm750fb/lynxfb kernel module (via /etc/modprobe.d/) eliminates the attack surface entirely on systems not requiring SM750 GPU functionality, with the trade-off of losing display output on affected hardware.

Same weakness CWE-369 – Divide By Zero

View all
CVE-2017-11720 CRITICAL POC
9.8
CVE-2012-0207 HIGH POC
7.5
CVE-2017-7598 HIGH POC
7.8
CVE-2016-3623 HIGH POC
7.5
CVE-2023-3896 HIGH POC
7.8
CVE-2023-1127 HIGH POC
7.8
CVE-2023-0512 HIGH POC
7.8
CVE-2021-29600 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31603 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy