CVE-2026-23266: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23266 is a divide-by-zero vulnerability in the Linux kernel's fbdev/rivafb driver, specifically in the nv3_arb() function, that allows a local attacker to crash the kernel (denial of service). It was published on March 18, 2026, and affects Linux kernel versions from 2.6.12.1 up through multiple stable branches, including versions before 5.10.251, 5.15.201, 6.1.164, 6.6.127, 6.12.74, 6.18.13, and 6.19.3. Microsoft's Azure Linux 3 kernel (azl3_kernel_6.6.126.1-1) is also listed as affected. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is a missing zero-value check before a division operation in nv3_arb() within drivers/video/fbdev/riva/riva_hw.c, classified as CWE-369 (Divide By Zero). The driver derives state->mclk_khz from the PRAMDAC MCLK PLL configuration of the hardware; under normal conditions this value is non-zero, but a crafted or emulated PCI device can expose a bogus PLL configuration causing state->mclk_khz to be zero. When a local user invokes the FBIOPUT_VSCREENINFO ioctl on /dev/fb*, the driver calls nv3_get_param(), which in turn calls nv3_arb(), where the division by zero in the gns calculation triggers a kernel divide error and crash. The fix adds a pre-division check that bails out if state->mclk_khz is zero (Red Hat CVE, Kernel Patch).

Successful exploitation results in a kernel panic (divide error), causing a complete denial of service on the affected system. There is no impact on confidentiality or integrity — the vulnerability is limited to availability (CVSS AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). An attacker requires low-privilege local access and the ability to interact with /dev/fb* devices or introduce a malicious PCI device, limiting the blast radius to the local host without lateral movement potential (Red Hat CVE).

1. Gain local access: Obtain a low-privilege local user account on a system running a vulnerable Linux kernel version with the rivafb driver loaded and /dev/fb* devices accessible.
2. Prepare a malicious PCI device (optional): If the target system uses real RIVA NV3 hardware, the attacker may instead rely on a crafted or emulated PCI device (e.g., via QEMU) that exposes a bogus PRAMDAC MCLK PLL configuration, causing state->mclk_khz to be zero when read by the driver.
3. Trigger the ioctl: Call the FBIOPUT_VSCREENINFO ioctl on /dev/fb* (e.g., using a small C program or fbset utility) to cause the driver to recompute FIFO arbitration parameters.
4. Trigger the divide-by-zero: The ioctl causes nv3_get_param() → nv3_arb() to execute, where the division by the zero-valued state->mclk_khz triggers a kernel divide error, crashing the system (Red Hat CVE).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing divide error: 0000 [#1] PREEMPT SMP KASAN PTI followed by a stack trace referencing nv3_arb and nv3_get_param in drivers/video/fbdev/riva/riva_hw.c.
• Logs: Kernel log entry rivafb: setting virtual Y resolution to <value> immediately preceding the crash, indicating a FBIOPUT_VSCREENINFO ioctl was issued.
• Process: Unexpected or repeated invocations of processes calling ioctl on /dev/fb* devices by non-root or non-display-manager users.
• System: Unexpected system reboots or kernel panics on systems with RIVA NV3 framebuffer hardware or emulated PCI devices (Red Hat CVE).

Apply the available kernel patches, which have been backported to the following stable branches: 5.10.251, 5.15.201, 6.1.164, 6.6.127, 6.12.74, 6.18.13, and 6.19.3. SUSE has released security advisories (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1) addressing this issue. As a workaround, restrict user access to /dev/fb* devices via appropriate file permissions, and limit the ability to attach or emulate PCI devices in virtualized environments (Red Hat CVE, SUSE Advisory, Microsoft MSRC).