CVE-2026-31605

The promoted vulnerability is a divide‑by‑zero error in the udlfb framebuffer driver that can be triggered via the FBIOPUT_VSCREENINFO ioctl. When the driver attempts to perform a division operation using pixclock without validating the divisor, a kernel crash occurs, causing the system to become unresponsive. The flaw does not provide direct escalation or data disclosure but results in an unstable system state and potential loss of uptime.

All Linux kernel builds that include the udlfb framebuffer driver are impacted, regardless of distribution. Any machine that runs a kernel containing the udlfb code before the fix will expose the flaw. This includes generic desktop and server kernels that ship with the driver enabled.

The CVSS score of 5.5, combined with an EPSS score of < 1%, indicates a very low likelihood of exploitation in the wild. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is local: an entity that can open the framebuffer device and issue the FBIOPUT_VSCREENINFO ioctl can trigger the crash. Privileged users typically have access to the framebuffer; thus the risk is confined to systems where non‑root processes might be able to use the device, or where privilege escalation exists.