CVE-2026-23266 in Linux
Summary
by MITRE • 03/18/2026
In the Linux kernel, the following vulnerability has been resolved:
fbdev: rivafb: fix divide error in nv3_arb()
A userspace program can trigger the RIVA NV3 arbitration code by calling the FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver recomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz (derived from the PRAMDAC MCLK PLL) as a divisor without validating it first.
In a normal setup, state->mclk_khz is provided by the real hardware and is non-zero. However, an attacker can construct a malicious or misconfigured device (e.g. a crafted/emulated PCI device) that exposes a bogus PLL configuration, causing state->mclk_khz to become zero. Once nv3_get_param() calls nv3_arb(), the division by state->mclk_khz in the gns calculation causes a divide error and crashes the kernel.
Fix this by checking whether state->mclk_khz is zero and bailing out before doing the division.
The following log reveals it:
rivafb: setting virtual Y resolution to 2184 divide error: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline]
RIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546 Call Trace: nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603 nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline]
CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246 riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779 rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196 fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188 __x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/01/2026
The vulnerability CVE-2026-23266 represents a critical divide-by-zero error in the Linux kernel's framebuffer driver for RIVA graphics hardware, specifically within the rivafb module. This issue manifests when a userspace program invokes the FBIOPUT_VSCREENINFO ioctl command on framebuffer devices such as /dev/fb*, triggering the nv3_arb() function that handles FIFO arbitration parameters. The flaw occurs due to inadequate validation of the mclk_khz parameter, which is derived from the PRAMDAC MCLK PLL configuration and serves as a divisor in arithmetic calculations. Under normal operating conditions, this value is reliably provided by actual hardware and remains non-zero. However, the vulnerability becomes exploitable when an attacker constructs a malicious or misconfigured device, such as a crafted or emulated PCI device, that presents a bogus PLL configuration causing mclk_khz to become zero. This scenario directly violates the fundamental principle of input validation and demonstrates a classic security flaw that can lead to system instability and potential privilege escalation.
The technical implementation of this vulnerability follows a specific execution path that begins with userspace triggering the FBIOPUT_VSCREENINFO ioctl call, which subsequently invokes nv3_get_param() function. This function then calls nv3_arb() where the division operation occurs using state->mclk_khz as the denominator without prior validation. The arithmetic calculation in question specifically involves the gns parameter computation, where division by zero results in immediate kernel panic and system crash. The kernel stack trace reveals the precise function call sequence leading to the divide error, with the error occurring at drivers/video/fbdev/riva/riva_hw.c line 439 within the nv3_arb function. This execution flow aligns with ATT&CK technique T1068 which covers 'Exploitation for Privilege Escalation' and CWE-369 which describes 'Division by Zero', making this vulnerability a clear example of both a kernel-level arithmetic error and a privilege escalation vector.
The operational impact of this vulnerability extends beyond simple system crashes, as it represents a potential denial-of-service attack vector that can be exploited by unprivileged users to crash the entire kernel. The vulnerability affects systems running the Linux kernel with rivafb framebuffer drivers, particularly those utilizing RIVA graphics hardware such as nVidia GeForce 256 and related chipsets. In practical attack scenarios, an attacker could exploit this through crafted device drivers or virtualized environments that present malformed hardware configurations, potentially leading to system instability that could be leveraged for more sophisticated attacks. The crash occurs during the graphics mode configuration process, which means it could affect both server and desktop systems during normal operation or system initialization phases, making it particularly dangerous in production environments where system stability is critical.
The fix for this vulnerability involves implementing a simple but crucial validation check that verifies whether state->mclk_khz is zero before performing any division operations. This remediation approach directly addresses the root cause by preventing the divide-by-zero condition through defensive programming practices that align with security best practices. The solution demonstrates proper input validation and error handling, ensuring that the kernel does not proceed with arithmetic operations on invalid data. This fix should be implemented as a defensive programming measure that prevents the kernel from crashing while maintaining the integrity of the graphics subsystem. The remediation aligns with industry standards for kernel security and follows the principle of least privilege, ensuring that even in the presence of malformed hardware configurations, the system remains stable and secure. The implementation of this fix requires minimal code changes and provides maximum security benefit, making it an ideal solution for preventing exploitation of this class of vulnerability.