CVE-2026-31770

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (occ) Fix division by zero in occ_show_power_1()

In occ_show_power_1() case 1, the accumulator is divided by

update_tag without checking for zero. If no samples have been

collected yet (e.g. during early boot when the sensor block is

included but hasn't been updated), update_tag is zero, causing

a kernel divide-by-zero crash.

The 2019 fix in commit 211186cae14d ("hwmon: (occ) Fix division by

zero issue") only addressed occ_get_powr_avg() used by

occ_show_power_2() and occ_show_power_a0(). This separate code

path in occ_show_power_1() was missed.

Fix this by reusing the existing occ_get_powr_avg() helper, which

already handles the zero-sample case and uses mul_u64_u32_div()

to multiply before dividing for better precision. Move the helper

above occ_show_power_1() so it is visible at the call site.

[groeck: Fix alignment problems reported by checkpatch]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References