Division by zero in Linux kernel - CVE-2026-98390

Vulnerability identifier: #VU155935

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98390

CWE-ID: CWE-369

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the amd_smn_init() function in arch/x86/kernel/amd_node.c when initializing a system whose topology causes roots_per_node to be calculated as zero. A local user can trigger the affected initialization under these topology conditions to cause a denial of service.

The issue has been observed in Xen PVH dom0 with two nodes and one root, but other systems may also be affected.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/72bd92bd8190d7869ecb462649ca40f297822a33
• https://git.kernel.org/stable/c/9273a90465d58b82aca4bea71451ef6bee084928
• https://git.kernel.org/stable/c/94e984d8858a3228952b02f84e66610961098cc2

• Division by zero in Linux kernel x86 kernel
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more