What’s Vulnerable › Vulnerabilities

CVE-2026-31618: fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-06-17
• Weakness: CWE-369

Description

In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the udlfb driver as it uses pixclock directly when dividing, which will crash.

Affected products

• Linux kernel: from 2.6.12.1 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1; 2.6.12, 2.6.12-rc2, 2.6.12-rc3, 2.6.12-rc4, 2.6.12-rc5 — fixed in 6.12.83, 6.18.24, 6.19.14, 6.6.136, 7.0.1

How to fix

Upgrade to a fixed version: Linux kernel 6.12.83, 6.18.24, 6.19.14, 6.6.136. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2f207e46c62688bb7eb4e3feaf9a0d94020fb0c9
• https://git.kernel.org/stable/c/53cb4e79a07124d2ebe502983c29800104080b47
• https://git.kernel.org/stable/c/59bde9e0930efef1286768cb65fc78d5e5267f93
• https://git.kernel.org/stable/c/63dfb0b4741f46d65b667c4275132b3d1966acc8
• https://git.kernel.org/stable/c/6567d3e1aaadfebf44ce7dc9ea2630323cd4c736
• https://git.kernel.org/stable/c/6c05191598eca87a87329b3f6e4a0825775f09cf
• https://git.kernel.org/stable/c/859a239d58a812b61267d9944b701affe6a6244e
• https://git.kernel.org/stable/c/8f98b81fe011e1879e6a7b1247e69e06a5e17af2
• https://git.kernel.org/stable/c/fc386daa6846551a88d338ba9864fc2812cd9030

Get alerted when CVE-2026-31618 or the next vulnerability affects your stack