CVE-2026-98722 Linux CVE debrief

Who should care

Linux kernel developers and administrators who use the block2mtd module should be aware of this vulnerability and take steps to mitigate it. They should verify that the erase size is set to a valid value and monitor system logs for divide error messages. This vulnerability can cause system crashes and potential denial of service (DoS) attacks, and it is essential to review and update Linux kernel configurations to ensure the block2mtd module is properly

Why it matters

This vulnerability can cause system crashes and potential denial of service (DoS) attacks when the erase size is set to zero. Linux kernel developers and administrators who use the block2mtd module should verify that the erase size is set to a valid value and monitor system logs for divide error messages.

• System crashes due to divide errors
• Potential denial of service (DoS) attacks
• Need for verification of erase size values

Technical summary

The Linux kernel's block2mtd module is vulnerable to a divide error when the erase size is set to zero. This can cause a divide error when evaluating the device size modulo the erase size. The vulnerability can lead to system crashes and potential denial of service (DoS) attacks. The erase size is parsed from the 'block2mtd' module parameter and can be set to zero. To mitigate this vulnerability, Linux kernel developers and administrators should verify that the erase size is set to a valid value and monitor system logs for divide error messages.

Defensive priority

Medium

Recommended defensive actions

• Review and update Linux kernel configurations to ensure the block2mtd module is properly configured.
• Verify that the erase size is set to a valid value when using the block2mtd module.
• Monitor system logs for divide error messages related to the block2mtd module.
• Perform a thorough review of the Linux kernel configurations and the block2mtd module to identify potential vulnerabilities.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The vulnerability is caused by a zero divisor when calculating the device size modulo the erase size. The erase size is parsed from the 'block2mtd' module parameter and can be set to zero. This can cause a divide error when evaluating the device size modulo the erase size. The existing 'erasesize must be a divisor of device size' error path reports the invalid argument and frees the device. To verify, defenders should check the 'block2mtd' module parameter and ensure the erase size is set to a valid value.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.