An earlier version of the block2mtd driver in the Linux kernel performed a modulus operation on the install size using the erase_size module parameter as the divisor. When erase_size was set to zero, the kernel experienced a divide‑by‑zero error during module initialization, causing a panic. The resultant crash brings the entire operating system down, presenting a denial of service impact. The flaw is confined to the driver‑initialization phase and does not grant additional access or expose data.

All Linux kernel releases where the block2mtd driver is compiled and enabled are susceptible. Any system that loads the module with the erase_size parameter set to zero, or leaves it at the default that can be overridden, will trigger the fault. The vulnerability exists in the upstream kernel code and is therefore present in all distributions that ship the unmodified block2mtd driver, regardless of vendor. The version range is not explicitly listed, but any build containing the patched source is safe.

The CVSS score is 4.4, indicating moderate severity, while the EPSS score remains below 1%. The vulnerability is not in CISA’s KEV list. Based on the description, it is inferred that an attacker would need local privileged access to write to the module parameter through the sysfs interface or to load the module as root. An adversary with such capabilities can easily trigger a kernel panic, resulting in a denial of service. In environments where only non-privileged users can manipulate kernel modules, the likelihood of exploitation is low; however, once a privileged foothold exists, the risk becomes high.