All vulnerabilities
CVE-2026-98390

Linux: x86/amd_node: Avoid divide by zero on virtualized systems

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9273a90465d58b82aca4bea71451ef6bee084928Also 94e984d8858a3228952b02f84e66610961098cc2, 72bd92bd8190d7869ecb462649ca40f297822a33 and 1 moreCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 9273a90465d58b82aca4bea71451ef6bee084928LinuxCVE List
  • 94e984d8858a3228952b02f84e66610961098cc2LinuxCVE List
  • 72bd92bd8190d7869ecb462649ca40f297822a33LinuxCVE List
  • 6.18LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/amd_node: Avoid divide by zero on virtualized systems

On a virtualized system, the number of nodes does not have a relationship to the number of roots. A Xen PVH dom0 can calculate roots_per_node as 0, which crashes with a divide by zero in:

if (count++ % roots_per_node)

because the underlying topology code on Xen ends up making num_nodes 2 and num_roots 1 and the integer division result is 0.

The issue is seen with Xen, but it could affect other systems.

Set roots_per_node to 1 in this case. Print a firmware bug when this is performed for non-virtualized systems.

[ bp: Massage commit message. ]

Text from CVE List

Affected versions 10

  • Linuxaffected: 0a4b61d9c2e496b5f0a10e29e355a1465c8738bb before 9273a90465d58b82aca4bea71451ef6bee084928CVE List
  • Linuxaffected: 0a4b61d9c2e496b5f0a10e29e355a1465c8738bb before 94e984d8858a3228952b02f84e66610961098cc2CVE List
  • Linuxaffected: 0a4b61d9c2e496b5f0a10e29e355a1465c8738bb before 72bd92bd8190d7869ecb462649ca40f297822a33CVE List
  • Linuxaffected: c4ad899a33198ab6335732c769835d035e66894aCVE List
  • Linuxaffected: 6.17.8 before 6.18CVE List
  • Linuxaffected: 6.18CVE List
  • Linuxunaffected: all versions before 6.18CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3