{
  "public_date" : "2026-03-18T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: fbdev: rivafb: fix divide error in nv3_arb()",
    "id" : "2448684",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2448684"
  },
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nfbdev: rivafb: fix divide error in nv3_arb()\nA userspace program can trigger the RIVA NV3 arbitration code by calling\nthe FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver\nrecomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz\n(derived from the PRAMDAC MCLK PLL) as a divisor without validating it\nfirst.\nIn a normal setup, state->mclk_khz is provided by the real hardware and is\nnon-zero. However, an attacker can construct a malicious or misconfigured\ndevice (e.g. a crafted/emulated PCI device) that exposes a bogus PLL\nconfiguration, causing state->mclk_khz to become zero.  Once\nnv3_get_param() calls nv3_arb(), the division by state->mclk_khz in the gns\ncalculation causes a divide error and crashes the kernel.\nFix this by checking whether state->mclk_khz is zero and bailing out before\ndoing the division.\nThe following log reveals it:\nrivafb: setting virtual Y resolution to 2184\ndivide error: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\nRIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline]\nRIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546\nCall Trace:\nnv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603\nnv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline]\nCalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246\nriva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779\nrivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196\nfb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033\ndo_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109\nfb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188\n__x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856" ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-23266\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23266\nhttps://lore.kernel.org/linux-cve-announce/2026031853-CVE-2026-23266-b57b@gregkh/T" ],
  "name" : "CVE-2026-23266",
  "csaw" : false
}