CVE-2026-98722: mtd: block2mtd: Fix divide error when erase_size is zero
In the Linux kernel, the following vulnerability has been resolved:
mtd: block2mtd: Fix divide error when erasesize is zero
The erase size is parsed from the "block2mtd" module parameter and can be set to zero. adddevice() then evaluates
if (size % erasesize)
with a zero divisor, which triggers a divide error:
divide error: 0000 [#1] PREEMPT SMP PTI RIP: 0010:adddevice drivers/mtd/devices/block2mtd.c:296 [inline] RIP: 0010:block2mtdsetup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459 Call Trace: block2mtdsetup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476 paramattrstore+0x214/0x310 kernel/params.c:589 moduleattrstore+0x65/0x90 kernel/params.c:904 kernfsfopwriteiter+0x3a4/0x540 fs/kernfs/file.c:345 ...
Reject a zero erase size before performing the modulo operation so the existing "erasesize must be a divisor of device size" error path reports the invalid argument and frees the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the block2mtd module parameter with a non-zero erase size; zero erase sizes trigger a divide error.
Linux kernel block2mtd erase_size = non-zero