CVE Explorer

CVE-2026-23266

In the Linux kernel, the following vulnerability has been resolved: fbdev: rivafb: fix divide error in nv3_arb() A userspace program can trigger the RIVA NV3 arbitration code by calling the FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver recomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz (derived from the PRAMDAC MCLK PLL) as a divisor without validating it first. In a normal setup, state->mclk_khz is provided by the real hardware and is non-zero. Howe

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:70e837be7c8c78684e9fc824eaf1fb9a3c702fa2a5fed5d1a3546979dfb0d4fb

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/video/fbdev/riva/riva_hw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.251","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.201","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.164","versionType":"s…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/video/fbdev/riva/riva_hw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ec5a58f4fd581875593ea92a65485e1906a53c0f","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"52916878db2b8e3769743a94484729f0844352df","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"526460a96c5443e2fc0fd231edd1f9c49d2de26b","status":"affected","version":"1da177e4c3f…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/affected/0

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/affected/1

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/affected/0

Source references

8 source assertions

{"url":"https://git.kernel.org/stable/c/0209e21e3c372fa2da04c39214bec0b64e4eb5f4"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/references/7

{"url":"https://git.kernel.org/stable/c/3e4cbd1d46c246dfa684c8e9d8c20ae0b960c50a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/526460a96c5443e2fc0fd231edd1f9c49d2de26b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/52916878db2b8e3769743a94484729f0844352df"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/73f0391e92d404da68f7484e57c106c5e673dc7e"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/78daf5984d96edec3b920c72a93bd6821b8710b7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/9efa0dc46270a8723c158c64afbcf1dead72b28c"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/ec5a58f4fd581875593ea92a65485e1906a53c0f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b84dd4479d33834be30eeb7f596f766f54168f83676e7c6a77b7e1d3ee64d06f · sha256:816d9df4123376e2… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer