CVE-2026-98722 Overview
CVE-2026-98722 is a divide-by-zero flaw in the Linux kernel block2mtd driver located in drivers/mtd/devices/block2mtd.c. The driver parses an erase_size value from the block2mtd module parameter without rejecting zero. When add_device() evaluates size % erase_size with a zero divisor, the kernel triggers a divide error and panics. The fix rejects a zero erase_size before performing the modulo operation, routing the invalid argument through the existing error path that reports the issue and frees the device.
Critical Impact
A local user with the ability to set the block2mtd module parameter can trigger a kernel divide error, resulting in denial of service.
Affected Products
- Linux kernel versions containing the vulnerable drivers/mtd/devices/block2mtd.c code path
- Systems where the block2mtd module is loadable and its parameters are writable
- Distributions shipping kernels prior to the referenced stable commits
Discovery Timeline
- 2026-10-18 - CVE-2026-98722 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98722
Vulnerability Analysis
The block2mtd driver exposes a block device as a Memory Technology Device (MTD). Users configure the backing device and erase block size through the block2mtd module parameter. The parameter string is parsed in block2mtd_setup2() and passed into add_device() at drivers/mtd/devices/block2mtd.c:296.
Inside add_device(), the kernel validates that the device size is a multiple of the erase size using the expression if (size % erase_size). The code does not check whether erase_size is zero before this operation. A zero value causes an integer divide error, which raises an unhandled exception on x86 (divide error: 0000 [#1] PREEMPT SMP PTI) and oopses the kernel.
The fault is reached from userspace through the sysfs module parameter interface, specifically via kernfs_fop_write_iter → module_attr_store → param_attr_store → block2mtd_setup. This represents a classic input validation failure resulting in a divide-by-zero denial-of-service condition in kernel context.
Root Cause
The root cause is missing input validation on the erase_size parameter prior to its use as a divisor. The driver trusts user-supplied data and performs arithmetic without a lower-bound sanity check.
Attack Vector
A local user with write access to the block2mtd module parameter sysfs entry supplies a crafted parameter string containing a zero erase_size. The subsequent modulo operation triggers the divide error inside the kernel.
No verified public exploit code is available. See the kernel commits in the Linux stable tree for the authoritative patch and reproducer context.
Detection Methods for CVE-2026-98722
Indicators of Compromise
- Kernel oops messages containing divide error: 0000 with RIP pointing to add_device or block2mtd_setup2 in drivers/mtd/devices/block2mtd.c
- Unexpected loading of the block2mtd module on systems that do not normally use MTD-over-block functionality
- Writes to /sys/module/block2mtd/parameters/block2mtd originating from unprivileged or unusual processes
Detection Strategies
- Monitor dmesg and /var/log/kern.log for divide-error traces referencing block2mtd
- Audit modprobe, insmod, and sysfs parameter writes targeting block2mtd using auditd rules
- Alert on kernel panics or soft lockups correlated with MTD subsystem symbols
Monitoring Recommendations
- Ingest kernel ring buffer output into a centralized log platform and alert on divide error strings
- Track module load events through kernel.module_load audit records on multi-tenant hosts
- Baseline systems that legitimately use block2mtd and flag deviations
How to Mitigate CVE-2026-98722
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced below and reboot into the patched kernel
- Blacklist the block2mtd module on hosts that do not require MTD-over-block functionality
- Restrict write access to /sys/module/block2mtd/parameters/ to root and remove unnecessary capabilities from local accounts
Patch Information
The fix rejects a zero erase_size before the modulo operation, allowing the existing "erasesize must be a divisor of device size" error path to report the invalid argument and free the device. Patched commits in the stable tree include 21d0f05, 826170a, a991c28, b5965c4, and bff83b7.
Workarounds
- Add install block2mtd /bin/true to /etc/modprobe.d/ to prevent loading on systems that do not use the driver
- Enforce stricter sysfs permissions and remove unprivileged write paths to module parameters
- Deploy kernel lockdown or restrict CAP_SYS_MODULE to reduce the attack surface for module parameter abuse
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
