CVE-2026-46161
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies setu
CVSS
5.5
Medium
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: May 28, 2026 · Last modified: Oct 15, 2026 · CWE-369
0.1%EPSS · 30 days0.2%
2026-09-282026-10-25
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies setup_geo() extracts near_copies (nc) and far_copies (fc) from the user-provided layout parameter without checking for zero. When fc=0 with the "improved" far set layout selected, 'geo->far_set_size = disks / fc' triggers a divide-by-zero. Validate nc and fc immediately after extraction, returning -1 if either is zero.
- git.kernel.orghttps://git.kernel.org/stable/c/0b43a70394ce492274e67463326be03e0a9897c5
- git.kernel.orghttps://git.kernel.org/stable/c/4af2e558e6fdfb972c61350653fd55d1f62b60a5
- git.kernel.orghttps://git.kernel.org/stable/c/553e32adfa1a96b217651139a3f8c3b92b9984ac
- git.kernel.orghttps://git.kernel.org/stable/c/913d556e4bd1b56ed822815655b82c7bb54edc51
- git.kernel.orghttps://git.kernel.org/stable/c/9aa6d860b0930e2f72795665c42c44252a558a0c
- git.kernel.orghttps://git.kernel.org/stable/c/9d8e03b9a2b1e8ce5c198bf3a409a629f4d02cda
- git.kernel.orghttps://git.kernel.org/stable/c/c716ab3034f84f8a6c226814247b8c5ac9f95da1
- git.kernel.orghttps://git.kernel.org/stable/c/f9ddb621b2325eb69c95692958daf2bab4dea2c4
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-784472.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1120545.5 MED7.7%
——2Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data to trigger a SIGFPE and cause denial of service.5dCVE-2026-1120135.5 MED2.6%
——1libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the bundled tta console tool.7dCVE-2025-556535.5 MED7.8%
——2GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.6dCVE-2026-1106055.5 MED9.8%
——3libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process.12hCVE-2026-1071596.5 MED39.7%
——12MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.19dCVE-2026-1052504.3 MED24.7%
——7A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of the component Microsoft IMA Decoder. Such manipulation leads to divide by zero. The attack can be executed remotely.21d