CVE-2026-43354: Linux Kernel Division by Zero Vulnerability

CVE-2026-43354 Overview

CVE-2026-43354 is a division-by-zero flaw in the Linux kernel's Industrial I/O (IIO) subsystem, specifically in the hx9023s proximity sensor driver. The defect resides in the set_samp_freq function, which fails to validate the sampling frequency before using it as a divisor. A local user with access to the device can trigger the condition by submitting an unspecified or zero sampling frequency, causing a kernel-side arithmetic fault and denial of service. The issue is tracked under [CWE-369] (Divide By Zero) and has been resolved in upstream stable trees.

Critical Impact
A local, low-privileged user can crash the kernel by writing an unspecified sampling frequency to the hx9023s IIO proximity driver, resulting in a denial-of-service condition on affected systems.

Affected Products

Linux kernel mainline (pre-patch revisions of the iio/proximity/hx9023s driver)
Linux kernel 7.0-rc1
Linux kernel 7.0-rc2 and 7.0-rc3

Discovery Timeline

2026-05-08 - CVE-2026-43354 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43354

Vulnerability Analysis

The vulnerability exists in the hx9023s proximity sensor driver under drivers/iio/proximity/. The driver's set_samp_freq routine computes a divisor from the user-supplied sampling frequency to program the sensor's timing registers. When the frequency value is unspecified or evaluates to zero, the division operation produces a divide-by-zero fault in kernel context. The fault triggers a kernel oops, halting the offending task and potentially destabilizing the system. Because the IIO sysfs interface accepts the sampling frequency from userspace, any local process with write access to the relevant sysfs attribute can supply the malformed value.

Root Cause

The root cause is missing input validation in set_samp_freq. The function did not verify that the sampling frequency was nonzero before using it as a divisor. The upstream fix adds a guard that returns an error when the sampling frequency is unspecified, preventing the arithmetic exception. Refer to the Kernel Git Commit for the patch implementation.

Attack Vector

Exploitation requires local access and write privileges on the IIO sysfs attribute exposed by the hx9023s driver. An attacker writes a crafted or empty value to the sampling_frequency attribute, which propagates to set_samp_freq and triggers the divide-by-zero. The impact is limited to availability — there is no confidentiality or integrity loss — but a kernel oops on a production system can disrupt running workloads.

No verified public exploit code is available for this issue. See the upstream commits listed under vendor advisories for technical details of the defect and fix.

Detection Methods for CVE-2026-43354

Indicators of Compromise

Kernel oops or panic messages in dmesg referencing divide error and the hx9023s driver or set_samp_freq symbol.
Unexpected process termination or system reboots correlated with writes to IIO sampling_frequency sysfs attributes.

Detection Strategies

Audit kernel log buffers (journalctl -k, /var/log/kern.log) for divide_error traces involving IIO proximity drivers.
Inventory systems running kernel versions in the affected range that load the hx9023s module via lsmod or /proc/modules.
Monitor write activity to /sys/bus/iio/devices/iio:device*/sampling_frequency paths from non-root or unexpected processes.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on divide_error and IIO subsystem panics.
Track kernel package versions across the fleet to identify hosts still running unpatched builds.
Correlate sysfs write events with user identity to detect untrusted local users interacting with sensor interfaces.

How to Mitigate CVE-2026-43354

Immediate Actions Required

Update the Linux kernel to a version that includes the upstream fix commits referenced by the kernel.org stable tree.
Restrict local shell access on systems that expose the hx9023s proximity sensor, limiting which users can write to IIO sysfs attributes.
If the proximity sensor is unused, unload or blacklist the hx9023s module to remove the attack surface entirely.

Patch Information

The fix is available in the Linux kernel stable tree across multiple branches. Apply the patches from the following commits: 451ec5e6, 739fdfe6, a318cfc0, and ad9da7d3. Rebuild and redeploy the kernel, then reboot affected hosts to load the patched code.

Workarounds

Blacklist the hx9023s kernel module on systems that do not require the sensor by adding blacklist hx9023s to /etc/modprobe.d/.
Tighten permissions on IIO sysfs attributes so that only trusted system services can write sampling_frequency values.
Restrict local user accounts and enforce least privilege to reduce the population of users able to reach the vulnerable interface.

bash

# Configuration example: blacklist the affected driver until patched
echo 'blacklist hx9023s' | sudo tee /etc/modprobe.d/blacklist-hx9023s.conf
sudo rmmod hx9023s 2>/dev/null || true
sudo update-initramfs -u