Bug 2461450 (CVE-2026-31603)

Summary:	CVE-2026-31603 kernel: staging: sm750fb: fix division by zero in ps_to_hz()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's `sm750fb` framebuffer driver. A local user can exploit this vulnerability by providing a specially crafted input with a zero `pixclock` value via the `FBIOPUT_VSCREENINFO` ioctl. This leads to a division-by-zero error in the `ps_to_hz()` function, which can result in a system crash and a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-24 15:02:10 UTC

In the Linux kernel, the following vulnerability has been resolved:

staging: sm750fb: fix division by zero in ps_to_hz()

ps_to_hz() is called from hw_sm750_crtc_set_mode() without validating
that pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO
causes a division by zero.

Fix by rejecting zero pixclock in lynxfb_ops_check_var(), consistent
with other framebuffer drivers.

Comment 1 Keith Grant 2026-04-24 19:27:25 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026042419-CVE-2026-31603-bfce@gregkh/T