{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98722", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.366Z", "datePublished": "2026-10-18T15:46:58.093Z", "dateUpdated": "2026-10-21T12:56:04.591Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:56:04.591Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: block2mtd: Fix divide error when erase_size is zero\n\nThe erase size is parsed from the \"block2mtd\" module parameter and can\nbe set to zero. add_device() then evaluates\n\n if (size % erase_size)\n\nwith a zero divisor, which triggers a divide error:\n\ndivide error: 0000 [#1] PREEMPT SMP PTI\nRIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]\nRIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459\nCall Trace:\nblock2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476\nparam_attr_store+0x214/0x310 kernel/params.c:589\nmodule_attr_store+0x65/0x90 kernel/params.c:904\nkernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345\n...\n\nReject a zero erase size before performing the modulo operation so the\nexisting \"erasesize must be a divisor of device size\" error path\nreports the invalid argument and frees the device."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mtd/devices/block2mtd.c"], "versions": [{"version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "lessThan": "bff83b723e93acc788bd690dc4bc1f6f4356c35b", "status": "affected", "versionType": "git"}, {"version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "lessThan": "826170a49ca1315af6b293a02200585b1e2186d9", "status": "affected", "versionType": "git"}, {"version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "lessThan": "a991c28066e7ba4da7450bb04478849f7ac6a14a", "status": "affected", "versionType": "git"}, {"version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "lessThan": "21d0f05989bf0d5cef57b467a7fa4feefbd7236a", "status": "affected", "versionType": "git"}, {"version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "lessThan": "b5965c4221165045e19736794ca5f48ae3d67142", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/mtd/devices/block2mtd.c"], "versions": [{"version": "3.15", "status": "affected"}, {"version": "0", "lessThan": "3.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bff83b723e93acc788bd690dc4bc1f6f4356c35b"}, {"url": "https://git.kernel.org/stable/c/826170a49ca1315af6b293a02200585b1e2186d9"}, {"url": "https://git.kernel.org/stable/c/a991c28066e7ba4da7450bb04478849f7ac6a14a"}, {"url": "https://git.kernel.org/stable/c/21d0f05989bf0d5cef57b467a7fa4feefbd7236a"}, {"url": "https://git.kernel.org/stable/c/b5965c4221165045e19736794ca5f48ae3d67142"}], "title": "mtd: block2mtd: Fix divide error when erase_size is zero", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/mtd/devices/block2mtd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bff83b723e93acc788bd690dc4bc1f6f4356c35b", "status": "affected", "version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "versionType": "git"}, {"lessThan": "826170a49ca1315af6b293a02200585b1e2186d9", "status": "affected", "version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "versionType": "git"}, {"lessThan": "a991c28066e7ba4da7450bb04478849f7ac6a14a", "status": "affected", "version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "versionType": "git"}, {"lessThan": "21d0f05989bf0d5cef57b467a7fa4feefbd7236a", "status": "affected", "version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "versionType": "git"}, {"lessThan": "b5965c4221165045e19736794ca5f48ae3d67142", "status": "affected", "version": "ea6d833a3fddcd1d60414d48f34c7f4fbe88608f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/mtd/devices/block2mtd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.15"}, {"lessThan": "3.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: block2mtd: Fix divide error when erase_size is zero\n\nThe erase size is parsed from the \"block2mtd\" module parameter and can\nbe set to zero. add_device() then evaluates\n\n if (size % erase_size)\n\nwith a zero divisor, which triggers a divide error:\n\ndivide error: 0000 [#1] PREEMPT SMP PTI\nRIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]\nRIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459\nCall Trace:\nblock2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476\nparam_attr_store+0x214/0x310 kernel/params.c:589\nmodule_attr_store+0x65/0x90 kernel/params.c:904\nkernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345\n...\n\nReject a zero erase size before performing the modulo operation so the\nexisting \"erasesize must be a divisor of device size\" error path\nreports the invalid argument and frees the device."}], "id": "CVE-2026-98722", "lastModified": "2026-10-21T13:21:40.023", "metrics": {}, "published": "2026-10-18T16:17:25.813", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/21d0f05989bf0d5cef57b467a7fa4feefbd7236a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/826170a49ca1315af6b293a02200585b1e2186d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a991c28066e7ba4da7450bb04478849f7ac6a14a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b5965c4221165045e19736794ca5f48ae3d67142"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bff83b723e93acc788bd690dc4bc1f6f4356c35b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mtd: block2mtd: Fix divide error when erase_size is zero", "id": "2555155", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555155"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-369", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmtd: block2mtd: Fix divide error when erase_size is zero\nThe erase size is parsed from the \"block2mtd\" module parameter and can\nbe set to zero. add_device() then evaluates\nif (size % erase_size)\nwith a zero divisor, which triggers a divide error:\ndivide error: 0000 [#1] PREEMPT SMP PTI\nRIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]\nRIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459\nCall Trace:\nblock2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476\nparam_attr_store+0x214/0x310 kernel/params.c:589\nmodule_attr_store+0x65/0x90 kernel/params.c:904\nkernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345\n...\nReject a zero erase size before performing the modulo operation so the\nexisting \"erasesize must be a divisor of device size\" error path\nreports the invalid argument and frees the device.", "A flaw was found in the Linux kernel's block2mtd driver. The driver fails to validate that the erase size module parameter is non-zero before performing a division operation during device initialization. A local user with privileges to modify kernel module parameters can exploit this vulnerability by supplying a zero erase size, triggering a division-by-zero error that crashes the kernel and results in a Denial of Service (DoS)."], "name": "CVE-2026-98722", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98722\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98722\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98722.mbox"], "threat_severity": "Moderate"}