VulnerabilityPublished 23 Oct 2026

CVE-2026-98919: Linux kernel · drm/xe: harden adjust_idledly() against divide-by-zero and overflow

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in 531d4cd03118224022dc21ae25af052ce2a9e267 : patch Linux kernel soon.

Data as of 26 Oct 2026, 15:32 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 531d4cd03118224022dc21ae25af052ce2a9e267, 90f467577ebc28c5bc4ba2f0f1b83a4419fb0740, 2bcbfc5e7bfa9cc76818c54db698da5bdc13d9ff

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to 531d4cd03118224022dc21ae25af052ce2a9e267, 90f467577ebc28c5bc4ba2f0f1b83a4419fb0740 or 2bcbfc5e7bfa9cc76818c54db698da5bdc13d9ff.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ d2de4410a88ffc6053300d03041cc73b8c85dbaf, < 531d4cd03118224022dc21ae25af052ce2a9e267	Fixed in 531d4cd03118224022dc21ae25af052ce2a9e267
LinuxLinux	Affected ≥ d2de4410a88ffc6053300d03041cc73b8c85dbaf, < 90f467577ebc28c5bc4ba2f0f1b83a4419fb0740	Fixed in 90f467577ebc28c5bc4ba2f0f1b83a4419fb0740
LinuxLinux	Affected ≥ d2de4410a88ffc6053300d03041cc73b8c85dbaf, < 2bcbfc5e7bfa9cc76818c54db698da5bdc13d9ff	Fixed in 2bcbfc5e7bfa9cc76818c54db698da5bdc13d9ff
LinuxLinux	Affected =6.15	Fixed in–

AI-suggested

A fix for this vulnerability has been implemented and is available in the Linux kernel source (commits 531d4cd03118224022dc21ae25af052ce2a9e267, 90f467577ebc28c5bc4ba2f0f1b83a4419fb0740, 2bcbfc5e7bfa9cc76818c54db698da5bdc13d9ff). Users and administrators should update to a Linux kernel version that includes these commits or later to remediate the issue. No additional mitigation steps are required beyond applying the official patch.

Description

CVE-2026-98919 is a vulnerability in the Linux kernel's drm/xe component affecting the adjust_idledly() function. The flaw involves multiple corner cases leading to divide-by-zero errors and integer overflows during delay calculations, which can cause kernel panics. The issue arises when the crystal clock is unrecognized, resulting in zero timestamp bases and subsequent divide-by-zero operations. Additional problems include 32-bit overflow in tick-to-nanosecond conversions and improper clamping that can trigger repeated warnings. The vulnerability has been fixed by adding early returns, using 64-bit arithmetic to prevent overflow, and improving clamping logic to avoid invalid delay programming.

Impact

The vulnerability can cause kernel panics due to divide-by-zero errors and integer overflows in the drm/xe driver's delay adjustment logic. This can lead to system instability or crashes during GPU initialization or operation. Additionally, improper clamping can cause repeated warning messages, potentially affecting system logs and diagnostics. There is no indication of remote code execution or privilege escalation from this flaw.

Summary

The Linux kernel drm/xe driver contained several corner-case bugs in the adjust_idledly() function. If the crystal clock was not recognized, the timestamp_base was zero, causing a divide-by-zero panic. Tick-to-nanosecond conversions used 32-bit arithmetic, which could overflow before division. When the IDLE_WAIT_TIME register read zero, clamping logic wrapped incorrectly, causing invalid delay values that triggered repeated warnings. The fix involved returning early on zero timestamp_base, switching to 64-bit arithmetic to prevent overflow, clamping delays properly to stay below maximum allowed values, and masking register writes to avoid clobbering unrelated bits. These changes prevent kernel panics and repeated warnings during initialization.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 15:32 UTC

Technical details

References

Community reviews

Related threats