CVE-2026-89821 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: avoid divide-by-zero in __is_lut_linear()
__is_lut_linear() computes the expected value of each entry with
expected = i * MAX_DRM_LUT_VALUE / (size - 1);
If it is ever called with a single-entry LUT, size - 1 is zero and the kernel takes a divide error (#DE). A LUT with fewer than two entries cannot describe a linear mapping anyway, so return false early instead of dividing by zero.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel contains a critical arithmetic flaw within the DRM AMD display subsystem that can lead to a system crash due to an integer division-by-zero error. This vulnerability resides specifically in the __is_lut_linear() function, which is responsible for determining whether a Look-Up Table (LUT) used for color correction or gamma adjustment follows a linear progression. The core of the issue lies in the mathematical formula employed by this function: expected = i * MAX_DRM_LUT_VALUE / (size - 1). This calculation attempts to verify if each entry in the LUT matches what would be expected from a strictly linear distribution across the defined range. However, the denominator relies on size minus one, where size represents the number of entries in the table. When this function is invoked with a single-entry LUT, meaning size equals one, the expression (size - 1) evaluates to zero. Consequently, the division operation triggers a divide error exception within the kernel space, resulting in an immediate crash or denial of service for the system running the affected Linux kernel version.
From a technical perspective, this flaw is classified under CWE-369, which denotes Divide By Zero vulnerabilities. The root cause is insufficient input validation regarding the dimensions of the data structure being processed. A LUT with fewer than two entries lacks the necessary points to define any meaningful linear mapping, as linearity requires at least two distinct coordinates to establish a slope and intercept. Therefore, attempting to perform mathematical operations that assume multiple data points on a single-point dataset is logically invalid regardless of the arithmetic outcome. The vulnerability arises because the code proceeds with the calculation without first checking if the size parameter allows for such an operation. This oversight highlights a common pattern in systems programming where edge cases involving minimal or empty datasets are not adequately guarded against, leading to unstable behavior when malformed or trivially small inputs reach this specific kernel routine.
The operational impact of this vulnerability is primarily a local denial of service. Since the divide-by-zero exception occurs within the kernel, it typically results in an oops or panic, causing the entire operating system to halt and require a reboot. An attacker with access to display configuration interfaces could potentially trigger this condition by manipulating LUT parameters through user-space applications that interact with the DRM subsystem. While direct remote exploitation is unlikely given the nature of display drivers requiring local hardware interaction, the severity lies in the stability risk posed to systems relying on AMD graphics hardware for critical operations. The lack of early validation means that any process capable of submitting a single-entry LUT can destabilize the kernel, undermining system reliability and availability without needing elevated privileges if the driver allows unprivileged userspace access to such configurations.
To mitigate this vulnerability, developers must implement strict input validation before performing arithmetic operations on array sizes or dimensions. The immediate fix involves adding a conditional check at the beginning of __is_lut_linear() to return false immediately if size is less than two. This approach not only prevents the division-by-zero error but also aligns with logical correctness, as a single point cannot constitute a linear function in this context. Beyond code changes, system administrators should ensure that kernel updates are applied promptly to patch these arithmetic flaws. Furthermore, adopting static analysis tools during development can help identify similar patterns where denominators depend on user-controlled or variable sizes without adequate bounds checking. Adhering to secure coding practices that validate all inputs against expected ranges before execution is essential for maintaining the integrity of low-level system components like display drivers.