PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46161 Linux CVE debrief

A divide-by-zero vulnerability exists in the Linux kernel's md/raid10 driver within the setup_geo() function. The function extracts near_copies (nc) and far_copies (fc) values from a user-provided layout parameter without validating that these values are non-zero. When fc equals zero and the 'improved' far set layout is selected, the calculation 'geo->far_set_size = disks / fc' triggers a divide-by-zero condition. The fix adds immediate validation of nc and fc after extraction, returning -1 if either value is zero. This vulnerability affects systems using Linux kernel RAID10 configurations where user-controlled layout parameters could be manipulated. The issue was resolved through kernel patches that enforce proper bounds checking on these layout parameters.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-09
Advisory published
2026-05-28
Advisory updated
2026-06-09

Who should care

Linux system administrators managing software RAID10 arrays, kernel security teams, and organizations running critical infrastructure on Linux systems with mdadm RAID configurations

Technical summary

The md/raid10 driver's setup_geo() function in the Linux kernel fails to validate that near_copies and far_copies values extracted from user-provided layout parameters are non-zero. When far_copies equals zero with the improved far set layout selected, a divide-by-zero occurs at 'geo->far_set_size = disks / fc'. The vulnerability is triggered during RAID10 array configuration. The fix implements immediate validation returning -1 for zero values.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches when available for your distribution
  • Validate RAID10 layout parameters in configuration management to prevent zero values for near_copies or far_copies
  • Monitor kernel logs for RAID10 setup failures that may indicate exploitation attempts
  • Review custom RAID10 configurations for potentially malformed layout parameters
  • Update to patched kernel versions once released by distribution maintainers

Evidence notes

CVE description confirms divide-by-zero in md/raid10 setup_geo() when far_copies=0 with improved far set layout. Five kernel.org stable branch commits provided as references. NVD status: Awaiting Analysis. No CVSS score assigned.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46161 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46161

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46161 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46161

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4af2e558e6fdfb972c61350653fd55d1f62b60a5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/913d556e4bd1b56ed822815655b82c7bb54edc51

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9aa6d860b0930e2f72795665c42c44252a558a0c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9d8e03b9a2b1e8ce5c198bf3a409a629f4d02cda

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f9ddb621b2325eb69c95692958daf2bab4dea2c4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.