CVE-2026-98390
In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Avoid divide by zero on virtualized systems On a virtualized system, the number of nodes does not have a relationship to the number of roots. A Xen PVH dom0 can calculate roots_per_node as 0, which crashes with a divide by zero in: if (count++ % roots_per_node) because the underlying topology code on Xen ends up making num_nodes 2 and num_roots 1 and the integer division result is 0. The issue is seen with Xen, but it could affect other systems. Set roots_per_node to 1 in this case. Print a firmware bug when this is performed for non-virtualized systems. [ bp: Massage commit message. ]
Affected versions
Linux kernel versions
6.17.8,
6.18
and later are affected. Fixed in
6.18.53,
7.2.7,
7.3-rc3
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-98390?
CVE-2026-98390 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.17.8 onward and has been patched in 6.18.53, 7.2.7 and 7.3-rc3. CVE-2026-98390 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98390?
Yes. CVE-2026-98390 has been patched. Fixed versions include 6.18.53, 7.2.7 and 7.3-rc3. If you are running Linux kernel 6.17.8 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98390 actively exploited?
No. CVE-2026-98390 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.