CVE-2026-98390

A low impact divide-by-zero flaw was found in the Linux kernel's x86 AMD node initialization code. On virtualized systems the number of nodes has no relationship to the number of roots; when a hypervisor reports a topology with more nodes than roots (as seen with Xen PVH dom0, where num_nodes=2 and num_roots=1), the integer division producing roots_per_node yields 0, and the subsequent modulo operation (count++ % roots_per_node) raises an unhandled divide-by-zero exception during system startup, crashing the kernel and causing a denial of service. Red Hat rated this flaw Low impact even though the CVSS 3.1 vector reflects a high availability impact, because reliably triggering it requires control over the virtual hardware or NUMA topology, which normally belongs to a hypervisor administrator rather than an ordinary user of the affected system, and the consequence is limited to availability with no memory corruption, information disclosure, or privilege escalation. Within Red Hat's portfolio, the vulnerable code is present only in the RHEL 9.8 and later 9.z streams, the RHEL 10.2 and later 10.z streams, and products built from them (Red Hat In-Vehicle OS 2 and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 using RHEL CoreOS 9). Earlier RHEL 6, 7, 8, and 9 releases, RHEL 10.0, and the Real Time kernel (kernel-rt) builds are not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are currently deferred given the low impact of this flaw; the residual risk is a boot-time kernel crash restricted to virtualized guests whose hypervisor exposes the atypical topology with more nodes than roots.