CVE-2026-31770
Linux Kernel 5.0 – 5.10.253
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-31770 is a medium-severity Divide By Zero (CWE-369) vulnerability in Linux Linux Kernel. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26583
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: hwmon: (occ) Fix division by zero in occ_show_power_1() In occ_show_power_1() case 1, the accumulator is divided by update_tag without checking for zero. If no samples have been collected yet (e.g.…
more
during early boot when the sensor block is included but hasn't been updated), update_tag is zero, causing a kernel divide-by-zero crash. The 2019 fix in commit 211186cae14d ("hwmon: (occ) Fix division by zero issue") only addressed occ_get_powr_avg() used by occ_show_power_2() and occ_show_power_a0(). This separate code path in occ_show_power_1() was missed. Fix this by reusing the existing occ_get_powr_avg() helper, which already handles the zero-sample case and uses mul_u64_u32_div() to multiply before dividing for better precision. Move the helper above occ_show_power_1() so it is visible at the call site. [groeck: Fix alignment problems reported by checkpatch]
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel divide-by-zero in hwmon driver directly enables local DoS via system/application exploitation leading to panic/crash.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the kernel patch that reuses occ_get_powr_avg() to eliminate the unchecked division by update_tag.
Mandates use of secure development standards and tools that would have caught the missing zero-sample guard in occ_show_power_1().
Requires robust error handling so that a zero divisor produces a safe failure instead of a kernel crash.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include code analysis, input validation, and testing that prevent divide-by-zero errors.
Vulnerability identification processes can discover divide-by-zero flaws via static analysis or testing.
Routine patching and replacement can remediate divide-by-zero bugs present in deployed software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect divide-by-zero conditions before release.
Secure development lifecycle includes input validation and error-handling practices that can prevent divide-by-zero faults.
Application security requirements can mandate checks for zero denominators and safe arithmetic handling.
Secure architecture principles encourage defensive coding patterns that avoid arithmetic exceptions.
Secure coding standards directly require validation to prevent divide-by-zero and similar runtime faults.