All vulnerabilities
CVE-2026-98722

Linux: mtd: block2mtd: Fix divide error when erase_size is zero

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in826170a49ca1315af6b293a02200585b1e2186d9Also 21d0f05989bf0d5cef57b467a7fa4feefbd7236aCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 826170a49ca1315af6b293a02200585b1e2186d9LinuxCVE List
  • 21d0f05989bf0d5cef57b467a7fa4feefbd7236aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

mtd: block2mtd: Fix divide error when erase_size is zero

The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evaluates

if (size % erase_size)

with a zero divisor, which triggers a divide error:

divide error: 0000 [#1] PREEMPT SMP PTI RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline] RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459 Call Trace: block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476 param_attr_store+0x214/0x310 kernel/params.c:589 module_attr_store+0x65/0x90 kernel/params.c:904 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 ...

Reject a zero erase size before performing the modulo operation so the existing "erasesize must be a divisor of device size" error path reports the invalid argument and frees the device.

Text from CVE List

Affected versions 12

  • Linuxaffected: ea6d833a3fddcd1d60414d48f34c7f4fbe88608f before bff83b723e93acc788bd690dc4bc1f6f4356c35bCVE List
  • Linuxaffected: ea6d833a3fddcd1d60414d48f34c7f4fbe88608f before 826170a49ca1315af6b293a02200585b1e2186d9CVE List
  • Linuxaffected: ea6d833a3fddcd1d60414d48f34c7f4fbe88608f before a991c28066e7ba4da7450bb04478849f7ac6a14aCVE List
  • Linuxaffected: ea6d833a3fddcd1d60414d48f34c7f4fbe88608f before 21d0f05989bf0d5cef57b467a7fa4feefbd7236aCVE List
  • Linuxaffected: ea6d833a3fddcd1d60414d48f34c7f4fbe88608f before b5965c4221165045e19736794ca5f48ae3d67142CVE List
  • Linuxaffected: 3.15CVE List
  • Linuxunaffected: all versions before 3.15CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5