GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23266 (GCVE-0-2026-23266)

Vulnerability from cvelistv5 – Published: 2026-03-18 17:44 – Updated: 2026-05-11 22:03
VLAI
Title
fbdev: rivafb: fix divide error in nv3_arb()
Summary
In the Linux kernel, the following vulnerability has been resolved: fbdev: rivafb: fix divide error in nv3_arb() A userspace program can trigger the RIVA NV3 arbitration code by calling the FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver recomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz (derived from the PRAMDAC MCLK PLL) as a divisor without validating it first. In a normal setup, state->mclk_khz is provided by the real hardware and is non-zero. However, an attacker can construct a malicious or misconfigured device (e.g. a crafted/emulated PCI device) that exposes a bogus PLL configuration, causing state->mclk_khz to become zero. Once nv3_get_param() calls nv3_arb(), the division by state->mclk_khz in the gns calculation causes a divide error and crashes the kernel. Fix this by checking whether state->mclk_khz is zero and bailing out before doing the division. The following log reveals it: rivafb: setting virtual Y resolution to 2184 divide error: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline] RIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546 Call Trace: nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603 nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline] CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246 riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779 rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196 fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188 __x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ec5a58f4fd581875593ea92a65485e1906a53c0f (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 52916878db2b8e3769743a94484729f0844352df (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 526460a96c5443e2fc0fd231edd1f9c49d2de26b (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 78daf5984d96edec3b920c72a93bd6821b8710b7 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9efa0dc46270a8723c158c64afbcf1dead72b28c (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3e4cbd1d46c246dfa684c8e9d8c20ae0b960c50a (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 73f0391e92d404da68f7484e57c106c5e673dc7e (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0209e21e3c372fa2da04c39214bec0b64e4eb5f4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 5.10.251 , ≤ 5.10.* (semver)
Unaffected: 5.15.201 , ≤ 5.15.* (semver)
Unaffected: 6.1.164 , ≤ 6.1.* (semver)
Unaffected: 6.6.127 , ≤ 6.6.* (semver)
Unaffected: 6.12.74 , ≤ 6.12.* (semver)
Unaffected: 6.18.13 , ≤ 6.18.* (semver)
Unaffected: 6.19.3 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/riva/riva_hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ec5a58f4fd581875593ea92a65485e1906a53c0f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "52916878db2b8e3769743a94484729f0844352df",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "526460a96c5443e2fc0fd231edd1f9c49d2de26b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "78daf5984d96edec3b920c72a93bd6821b8710b7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9efa0dc46270a8723c158c64afbcf1dead72b28c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3e4cbd1d46c246dfa684c8e9d8c20ae0b960c50a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "73f0391e92d404da68f7484e57c106c5e673dc7e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0209e21e3c372fa2da04c39214bec0b64e4eb5f4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/riva/riva_hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.251",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.127",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.74",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: rivafb: fix divide error in nv3_arb()\n\nA userspace program can trigger the RIVA NV3 arbitration code by calling\nthe FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver\nrecomputes FIFO arbitration parameters in nv3_arb(), using state-\u003emclk_khz\n(derived from the PRAMDAC MCLK PLL) as a divisor without validating it\nfirst.\n\nIn a normal setup, state-\u003emclk_khz is provided by the real hardware and is\nnon-zero. However, an attacker can construct a malicious or misconfigured\ndevice (e.g. a crafted/emulated PCI device) that exposes a bogus PLL\nconfiguration, causing state-\u003emclk_khz to become zero.  Once\nnv3_get_param() calls nv3_arb(), the division by state-\u003emclk_khz in the gns\ncalculation causes a divide error and crashes the kernel.\n\nFix this by checking whether state-\u003emclk_khz is zero and bailing out before\ndoing the division.\n\nThe following log reveals it:\n\nrivafb: setting virtual Y resolution to 2184\ndivide error: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\nRIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline]\nRIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546\nCall Trace:\n  nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603\n  nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline]\n  CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246\n  riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779\n  rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196\n  fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033\n  do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109\n  fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188\n  __x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:03:32.226Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ec5a58f4fd581875593ea92a65485e1906a53c0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/52916878db2b8e3769743a94484729f0844352df"
        },
        {
          "url": "https://git.kernel.org/stable/c/526460a96c5443e2fc0fd231edd1f9c49d2de26b"
        },
        {
          "url": "https://git.kernel.org/stable/c/78daf5984d96edec3b920c72a93bd6821b8710b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9efa0dc46270a8723c158c64afbcf1dead72b28c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e4cbd1d46c246dfa684c8e9d8c20ae0b960c50a"
        },
        {
          "url": "https://git.kernel.org/stable/c/73f0391e92d404da68f7484e57c106c5e673dc7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0209e21e3c372fa2da04c39214bec0b64e4eb5f4"
        }
      ],
      "title": "fbdev: rivafb: fix divide error in nv3_arb()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23266",
    "datePublished": "2026-03-18T17:44:48.715Z",
    "dateReserved": "2026-01-13T15:37:45.991Z",
    "dateUpdated": "2026-05-11T22:03:32.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23266",
      "date": "2026-09-16",
      "epss": "0.00114",
      "percentile": "0.01699"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-27T14:38:41.000Z",
      "cve": "CVE-2026-23266",
      "id": "msrc_CVE-2026-23266",
      "initial_release_date": "2026-03-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "fbdev: rivafb: fix divide error in nv3_arb()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-23266.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23266\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-18T18:16:25.370\",\"lastModified\":\"2026-06-17T10:21:13.010\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfbdev: rivafb: fix divide error in nv3_arb()\\n\\nA userspace program can trigger the RIVA NV3 arbitration code by calling\\nthe FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver\\nrecomputes FIFO arbitration parameters in nv3_arb(), using state-\u003emclk_khz\\n(derived from the PRAMDAC MCLK PLL) as a divisor without validating it\\nfirst.\\n\\nIn a normal setup, state-\u003emclk_khz is provided by the real hardware and is\\nnon-zero. However, an attacker can construct a malicious or misconfigured\\ndevice (e.g. a crafted/emulated PCI device) that exposes a bogus PLL\\nconfiguration, causing state-\u003emclk_khz to become zero.  Once\\nnv3_get_param() calls nv3_arb(), the division by state-\u003emclk_khz in the gns\\ncalculation causes a divide error and crashes the kernel.\\n\\nFix this by checking whether state-\u003emclk_khz is zero and bailing out before\\ndoing the division.\\n\\nThe following log reveals it:\\n\\nrivafb: setting virtual Y resolution to 2184\\ndivide error: 0000 [#1] PREEMPT SMP KASAN PTI\\nCPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\\nRIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline]\\nRIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546\\nCall Trace:\\n  nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603\\n  nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline]\\n  CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246\\n  riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779\\n  rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196\\n  fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033\\n  do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109\\n  fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188\\n  __x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nfbdev: rivafb: corrige error de divisi\u00f3n en nv3_arb()\\n\\nUn programa de espacio de usuario puede activar el c\u00f3digo de arbitraje RIVA NV3 llamando al ioctl FBIOPUT_VSCREENINFO en /dev/fb*. Al hacerlo, el controlador recalcula los par\u00e1metros de arbitraje FIFO en nv3_arb(), usando state-\u0026gt;mclk_khz (derivado del PRAMDAC MCLK PLL) como divisor sin validarlo primero.\\n\\nEn una configuraci\u00f3n normal, state-\u0026gt;mclk_khz es proporcionado por el hardware real y no es cero. Sin embargo, un atacante puede construir un dispositivo malicioso o mal configurado (p. ej., un dispositivo PCI manipulado/emulado) que expone una configuraci\u00f3n PLL falsa, haciendo que state-\u0026gt;mclk_khz se vuelva cero. Una vez que nv3_get_param() llama a nv3_arb(), la divisi\u00f3n por state-\u0026gt;mclk_khz en el c\u00e1lculo de gns causa un error de divisi\u00f3n y bloquea el kernel.\\n\\nSolucione esto verificando si state-\u0026gt;mclk_khz es cero y saliendo antes de realizar la divisi\u00f3n.\\n\\nEl siguiente registro lo revela:\\n\\nrivafb: estableciendo la resoluci\u00f3n Y virtual a 2184\\nerror de divisi\u00f3n: 0000 [#1] PREEMPT SMP KASAN PTI\\nCPU: 0 PID: 2187 Comm: syz-executor.0 No contaminado 5.18.0-rc1+ #1\\nNombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014\\nRIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline]\\nRIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546\\nTraza de llamada:\\n  nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603\\n  nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline]\\n  CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246\\n  riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779\\n  rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196\\n  fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033\\n  do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109\\n  fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188\\n  __x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/video/fbdev/riva/riva_hw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"ec5a58f4fd581875593ea92a65485e1906a53c0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"52916878db2b8e3769743a94484729f0844352df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"526460a96c5443e2fc0fd231edd1f9c49d2de26b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"78daf5984d96edec3b920c72a93bd6821b8710b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"9efa0dc46270a8723c158c64afbcf1dead72b28c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"3e4cbd1d46c246dfa684c8e9d8c20ae0b960c50a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"73f0391e92d404da68f7484e57c106c5e673dc7e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"0209e21e3c372fa2da04c39214bec0b64e4eb5f4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/video/fbdev/riva/riva_hw.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.251\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.201\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.164\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.127\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.74\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.13\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.3\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-369\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.12.1\",\"versionEndExcluding\":\"5.10.251\",\"matchCriteriaId\":\"CABFF5E9-C52A-4642-9228-1D6E483DA497\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.201\",\"matchCriteriaId\":\"600A89ED-86F2-48D8-BB7C-5EE7A8832FC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.164\",\"matchCriteriaId\":\"6892F74B-3F14-4500-9652-24A2ECB04144\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.127\",\"matchCriteriaId\":\"4A9F36A3-A685-48A0-84B4-6217052BD058\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.74\",\"matchCriteriaId\":\"C2968F55-D03F-42BE-A694-F0A37BC8CBE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.13\",\"matchCriteriaId\":\"6BDEF9FB-423E-49F6-991B-9277CC3AF400\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.3\",\"matchCriteriaId\":\"7853A337-FB2A-4E19-AB47-4E38343532AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F76C298-81DC-43E4-8FC9-DC005A2116EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AB349B2-3F78-4197-882B-90ADB3BF645A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AC88830-A9BC-4607-B572-A4B502FC9FD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"476CB3A5-D022-4F13-AAEF-CB6A5785516A\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0209e21e3c372fa2da04c39214bec0b64e4eb5f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e4cbd1d46c246dfa684c8e9d8c20ae0b960c50a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/526460a96c5443e2fc0fd231edd1f9c49d2de26b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/52916878db2b8e3769743a94484729f0844352df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/73f0391e92d404da68f7484e57c106c5e673dc7e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78daf5984d96edec3b920c72a93bd6821b8710b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9efa0dc46270a8723c158c64afbcf1dead72b28c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec5a58f4fd581875593ea92a65485e1906a53c0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:19:49+00:00",
      "cve": "CVE-2026-23266",
      "id": "CVE-2026-23266",
      "initial_release_date": "2026-03-18T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fbdev: rivafb: fix divide error in nv3_arb()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23266.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-15T05:30:44Z",
      "cve": "CVE-2026-23266",
      "id": "CVE-2026-23266",
      "initial_release_date": "2026-03-19T00:26:48Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "61",
      "product_status:known_not_affected": "204",
      "product_status:recommended": "268",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23266",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23266.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.