CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix divide-by-zero in setupgeo() with zero farcopies
setupgeo() extracts nearcopies (nc) and farcopies (fc) from the user-provided layout parameter without checking for zero. When fc=0 with the "improved" far set layout selected, 'geo->farsetsize = disks / fc' triggers a divide-by-zero.
Validate nc and fc immediately after extraction, returning -1 if either is zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel RAID10 md subsystem are exposed when a user can provide a RAID10 layout that selects the improved far-set layout with far_copies set to zero. The affected software list includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1.
What does an attacker need to trigger the failure?
The attacker needs local access and low privileges, with the ability to supply a RAID10 layout parameter. No user interaction is required; the vulnerable condition is far_copies=0 in an improved far-set layout.
What is the impact of successful exploitation?
The invalid layout causes a divide-by-zero in setup_geo() when calculating far_set_size. The CVSS vector identifies the impact as availability-only, with high availability impact and no confidentiality or integrity impact.
What mitigation is available if an updated kernel cannot be deployed immediately?
Prevent untrusted or low-privileged users from creating or configuring RAID10 arrays with user-provided layout parameters. In particular, reject improved far-set RAID10 layouts where either near_copies or far_copies is zero.