Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can let a local userspace action crash the system when the legacy rivafb framebuffer driver processes a bad video configuration from a malicious or misconfigured device. The business impact is availability, not confirmed data theft or privilege escalation. Exposure appears specialized and hardware or virtualization dependent.
Executive priority
Treat this as a targeted availability risk. Prioritize patching where Linux hosts use framebuffer devices, legacy NVIDIA RIVA support, or device emulation. For typical servers without rivafb exposure, handle through normal kernel maintenance after confirming configuration.
Technical view
The bug is a divide-by-zero in rivafb nv3_arb(). FBIOPUT_VSCREENINFO on /dev/fb* can trigger recalculation using state->mclk_khz as a divisor. If a crafted or misconfigured RIVA NV3 PCI device reports PLL data that makes mclk_khz zero, the kernel hits a divide error and crashes. The fix checks zero before division.
Likely exposure
Likely limited to Linux systems with the rivafb framebuffer driver active and framebuffer devices exposed. The source specifically describes crafted, emulated, or misconfigured PCI device conditions; the crash log is from QEMU. Confirm exposure through kernel configuration, loaded modules, and distro package status.
Exploitation context
The bundle does not show active exploitation, and KEV is false. The described trigger requires local userspace interaction with /dev/fb* plus device state that causes a zero memory clock. Evidence supports denial of service through kernel crash, not remote compromise.
Researcher notes
The CVE evidence is specific: FBIOPUT_VSCREENINFO reaches nv3_get_param(), then nv3_arb(), where mclk_khz was used unchecked. The source names the remediation as a zero check and early bailout. No CVSS, CWE, exploit proof, or broader impact claims are provided.
Mitigation direction
- Apply Linux kernel updates containing the listed stable rivafb fix.
- Check distro or vendor advisories for fixed kernel package mappings.
- Disable or avoid loading rivafb where it is not operationally required.
- Limit access to framebuffer devices to trusted local users and services.
- Avoid exposing systems to untrusted or attacker-controlled PCI device emulation.
Validation and detection
- Inventory systems for active rivafb or RIVA framebuffer support.
- Check whether /dev/fb* exists and who can access it.
- Map running kernel versions to vendor-fixed builds or listed stable commits.
- Review virtualization environments for untrusted emulated PCI device exposure.
- Confirm patch presence by vendor changelog or kernel source package.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23266 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ec5a58f4fd581875593ea92a65485e1906a53c0fCVE reference, Linux
- https://git.kernel.org/stable/c/52916878db2b8e3769743a94484729f0844352dfCVE reference, Linux
- https://git.kernel.org/stable/c/526460a96c5443e2fc0fd231edd1f9c49d2de26bCVE reference, Linux
- https://git.kernel.org/stable/c/78daf5984d96edec3b920c72a93bd6821b8710b7CVE reference, Linux
- https://git.kernel.org/stable/c/9efa0dc46270a8723c158c64afbcf1dead72b28cCVE reference, Linux
- https://git.kernel.org/stable/c/3e4cbd1d46c246dfa684c8e9d8c20ae0b960c50aCVE reference, Linux
- https://git.kernel.org/stable/c/73f0391e92d404da68f7484e57c106c5e673dc7eCVE reference, Linux
- https://git.kernel.org/stable/c/0209e21e3c372fa2da04c39214bec0b64e4eb5f4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.