CVE-2022-50102: 
Linux Kernel vulnerability analysis and mitigation

A divide-by-zero vulnerability was discovered in the Linux kernel's video framebuffer device driver (arkfb). The vulnerability, identified as CVE-2022-50102, affects the arksetpixclock() function in the drivers/video/fbdev/arkfb.c file. The issue was disclosed on June 18, 2025 (NVD, Wiz).

The vulnerability occurs when a user can control the arguments of the ioctl() from user space. Under specific conditions, a divide-by-zero bug can be triggered in arksetpixclock() function at line 784: arksetpixclock(info, (hdiv info->var.pixclock) / hmul). When hdiv=1, pixclock=1, and hmul=2, the calculation results in (11)/2 = (int) 0. This leads to another division by zero at line 504: rv = dacsetfreq(par->dac, 0, 1000000000 / pixclock) (NVD).

When exploited, this vulnerability can cause a kernel crash through a divide-by-zero error, potentially leading to a denial of service condition. The vulnerability can be triggered by an unprivileged user with access to the framebuffer device (Wiz).

The vulnerability has been fixed by implementing a check on the argument of arksetpixclock() before performing the division operation. Users should update their Linux kernel to a version that includes this fix (Wiz).