CVE-2026-68356 Overview
CVE-2026-68356 is a division-by-zero flaw in the Linux kernel's Airoha watchdog driver. The driver calls clk_get_rate() to obtain the watchdog clock frequency and stores the value in wdt_freq. When the clock provider is misconfigured or the clock is unmanaged, clk_get_rate() returns 0. The driver then uses wdt_freq as a divisor in airoha_wdt_probe() when computing max_timeout and in airoha_wdt_get_timeleft() when computing remaining time. The resulting division by zero triggers a kernel fault. The upstream fix validates wdt_freq in probe and returns -EINVAL through dev_err_probe() before any division occurs.
Critical Impact
A division by zero in the Airoha watchdog probe path can crash the kernel during driver initialization or when userspace queries the remaining watchdog time, leading to denial of service on affected Airoha SoC-based systems.
Affected Products
- Linux kernel branches containing the Airoha watchdog driver (drivers/watchdog/airoha_wdt.c)
- Airoha SoC platforms relying on the in-tree watchdog driver
- Stable kernel trees prior to the commits referenced in the kernel.org fix set
Discovery Timeline
- 2026-08-10 - CVE-2026-68356 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68356
Vulnerability Analysis
The Airoha watchdog driver retrieves the clock rate through clk_get_rate() and stores the result in a local wdt_freq variable. The Linux clock framework can legitimately return 0 when the clock provider is not properly configured or the clock is unmanaged. The driver did not validate this return value before using it as a divisor.
Two code paths perform division by wdt_freq. The airoha_wdt_probe() function divides to compute max_timeout, the upper bound of the timeout range advertised to the watchdog core. The airoha_wdt_get_timeleft() function divides to convert a hardware counter into seconds of remaining time. Either path triggers a division-by-zero exception when wdt_freq is 0.
On most Linux architectures, an integer division by zero in kernel context raises a fault that terminates the current task with an oops or panics the kernel depending on configuration. The bug is classified as a denial-of-service condition rooted in missing input validation on a hardware-derived value.
Root Cause
The root cause is unchecked use of a value returned by clk_get_rate(). The driver assumed a nonzero clock rate. The fix adds a wdt_freq == 0 check in the probe function and returns -EINVAL through dev_err_probe(), which also logs a diagnostic message identifying the misconfigured clock provider.
Attack Vector
Exploitation requires the vulnerable driver to bind against a device whose clock provider yields a zero rate. This is typically a local condition tied to firmware, device tree, or clock driver configuration on Airoha SoC hardware rather than a remotely reachable interface. There is no evidence of remote exploitation or in-the-wild activity. The EPSS probability is 0.166% at the 6.229 percentile.
The vulnerability manifests during driver probe or when userspace queries the watchdog through /dev/watchdogN ioctls that reach airoha_wdt_get_timeleft(). See the referenced kernel.org commit for the sanitized fix.
Detection Methods for CVE-2026-68356
Indicators of Compromise
- Kernel oops or panic messages referencing airoha_wdt_probe or airoha_wdt_get_timeleft in dmesg and /var/log/kern.log.
- Divide error traces (divide error: 0000) originating from the watchdog subsystem on Airoha platforms.
- Repeated driver probe failures with -EINVAL after applying the patch, indicating an underlying clock misconfiguration that still needs remediation.
Detection Strategies
- Inventory kernel versions across Linux fleets and correlate against the fixed commits 57c3f5bd, 8681e5ad, and bcfcd761.
- Flag Airoha SoC devices running kernels that predate the patch set as vulnerable.
- Monitor for unexpected reboots on watchdog-managed devices, which can indicate the fault path was reached.
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM tier and alert on divide-by-zero and watchdog probe failure signatures.
- Track device availability metrics on Airoha-based endpoints; sudden reboots may correlate with the fault.
- Validate that clock providers referenced in the device tree are enabled before the watchdog node is probed.
How to Mitigate CVE-2026-68356
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 57c3f5bd, 8681e5ad, and bcfcd761 to all affected trees.
- Rebuild and deploy kernels for Airoha SoC devices with the patched drivers/watchdog/airoha_wdt.c.
- Audit device tree sources and clock driver configuration to ensure the watchdog clock reports a nonzero rate.
Patch Information
The fix is distributed across three stable-tree commits on kernel.org: 57c3f5bd5be008cd5b4ff6a45b7cb90f5ca45a37, 8681e5addf7171602616e256a09057697dcc75ca, and bcfcd7619f277842430d197556463b401b839ee9. The patch adds a wdt_freq == 0 guard in probe and returns -EINVAL with a dev_err_probe() diagnostic before any division executes.
Workarounds
- Blacklist the airoha_wdt module on systems where the watchdog is not required until the patched kernel can be deployed.
- Correct the underlying clock provider configuration in the device tree or platform firmware so clk_get_rate() returns a valid frequency.
- Disable userspace access to the watchdog character device on non-production systems to prevent reaching airoha_wdt_get_timeleft() via ioctl.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
