CVE-2026-31770: hwmon: (occ) Fix division by zero in occ_show_power_1()
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (occ) Fix division by zero in occshowpower1()
In occshowpower1() case 1, the accumulator is divided by updatetag without checking for zero. If no samples have been collected yet (e.g. during early boot when the sensor block is included but hasn't been updated), updatetag is zero, causing a kernel divide-by-zero crash.
The 2019 fix in commit 211186cae14d ("hwmon: (occ) Fix division by zero issue") only addressed occgetpowravg() used by occshowpower2() and occshowpowera0(). This separate code path in occshowpower1() was missed.
Fix this by reusing the existing occgetpowravg() helper, which already handles the zero-sample case and uses mulu64u32div() to multiply before dividing for better precision. Move the helper above occshowpower1() so it is visible at the call site.
[groeck: Fix alignment problems reported by checkpatch]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Update occ_show_power_1() case 1 to reuse the existing occ_get_powr_avg() helper, moving the helper above occ_show_power_1() so it is visible at the call site; this handles the zero-sample case and uses mul_u64_u32_div() before dividing.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31770?
CVE-2026-31770 has been classified as a medium severity vulnerability due to the potential for a division by zero error.
How do I fix CVE-2026-31770?
To fix CVE-2026-31770, update to the latest patched version of the Linux kernel that addresses the division by zero issue.
What systems are affected by CVE-2026-31770?
CVE-2026-31770 affects the Linux kernel due to its handling of power measurements in the hardware monitoring subsystem.
What is the impact of CVE-2026-31770?
The impact of CVE-2026-31770 includes possible denial of service due to system crashes resulting from the division by zero.
How can I determine if my system is vulnerable to CVE-2026-31770?
You can determine if your system is vulnerable to CVE-2026-31770 by checking the kernel version and comparing it against the fixed versions provided in the security advisories.