CVE-2026-23266

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: rivafb: fix divide error in nv3_arb()

A userspace program can trigger the RIVA NV3 arbitration code by calling

the FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver

recomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz

(derived from the PRAMDAC MCLK PLL) as a divisor without validating it

first.

In a normal setup, state->mclk_khz is provided by the real hardware and is

non-zero. However, an attacker can construct a malicious or misconfigured

device (e.g. a crafted/emulated PCI device) that exposes a bogus PLL

configuration, causing state->mclk_khz to become zero. Once

nv3_get_param() calls nv3_arb(), the division by state->mclk_khz in the gns

calculation causes a divide error and crashes the kernel.

Fix this by checking whether state->mclk_khz is zero and bailing out before

doing the division.

The following log reveals it:

rivafb: setting virtual Y resolution to 2184

di

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References