CVE-2026-98722: mtd: block2mtd: Fix divide error when erase_size is zero
In the Linux kernel, the following vulnerability has been resolved:
mtd: block2mtd: Fix divide error when erasesize is zero
The erase size is parsed from the "block2mtd" module parameter and can be set to zero. adddevice() then evaluates
if (size % erasesize)
with a zero divisor, which triggers a divide error:
divide error: 0000 [#1] PREEMPT SMP PTI RIP: 0010:adddevice drivers/mtd/devices/block2mtd.c:296 [inline] RIP: 0010:block2mtdsetup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459 Call Trace: block2mtdsetup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476 paramattrstore+0x214/0x310 kernel/params.c:589 moduleattrstore+0x65/0x90 kernel/params.c:904 kernfsfopwriteiter+0x3a4/0x540 fs/kernfs/file.c:345 ...
Reject a zero erase size before performing the modulo operation so the existing "erasesize must be a divisor of device size" error path reports the invalid argument and frees the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
Who can trigger this condition?
A user or process able to set the block2mtd module parameter can supply an erase size of zero. The failure occurs while block2mtd is creating the device and evaluates the device size against that parameter.
What is the impact of setting the erase size to zero?
The kernel performs a modulo operation with a zero divisor, causing a divide error in block2mtd setup. The supplied data does not establish any impact beyond this kernel fault.
What should be done if the fix cannot be applied immediately?
Do not configure block2mtd with an erase size of zero. Restrict access to changing module parameters so untrusted users or processes cannot provide the invalid value.
How does the corrected behavior differ?
The fixed code rejects a zero erase size before the modulo operation. It follows the existing invalid-argument error path and frees the device instead of triggering a divide error.