What’s Vulnerable › Vulnerabilities

CVE-2026-31605: fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-06-17
• Weakness: CWE-369

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directly when dividing, which will crash.

Affected products

• Linux kernel: from 2.6.34 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1 — fixed in 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0.1

How to fix

Upgrade to a fixed version: Linux kernel 6.12.83, 6.18.24, 6.19.14, 6.6.136. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/03797cdee38ef19c87785622d423aabaafb71c5f
• https://git.kernel.org/stable/c/6de048d78f3029744778b7a2891745f3ca7c209a
• https://git.kernel.org/stable/c/828ce54b27de93bd9c67991bca5a2c76c76742de
• https://git.kernel.org/stable/c/9981de9fb5ae0d3d6bc5ff5ca63350c2a3cdc564
• https://git.kernel.org/stable/c/a31e4518bec70333a0a98f2946a12b53b45fe5b9
• https://git.kernel.org/stable/c/afaaaa38579f1252bb42b145f6e88a955c4f73f3
• https://git.kernel.org/stable/c/cccbf9b7fdab48ce4feb69c24f7f928aa8e4e8b8
• https://git.kernel.org/stable/c/cce24f70090e0decb597b88bc52e8ef8efed6105
• https://git.kernel.org/stable/c/fd50ab7dd4ee5bbb4aebffa76ae18484b03a8ea5

Get alerted when CVE-2026-31605 or the next vulnerability affects your stack