CVE-2026-98390

A flaw was found in the Linux kernel. When running in certain virtualized environments, an unexpected hardware topology reported by the hypervisor can cause the AMD node initialization logic to calculate a divisor of zero. This condition triggers an unhandled divide-by-zero error during system startup, crashing the kernel and resulting in a Denial of Service (DoS).

A low impact divide-by-zero flaw was found in the Linux kernel's x86 AMD node initialization code. On virtualized systems the number of nodes has no relationship to the number of roots; when a hypervisor reports a topology with more nodes than roots (as seen with Xen PVH dom0, where num_nodes=2 and num_roots=1), the integer division producing roots_per_node yields 0, and the subsequent modulo operation (count++ % roots_per_node) raises an unhandled divide-by-zero exception during system startup, crashing the kernel and causing a denial of service. Red Hat rated this flaw Low impact even though the CVSS 3.1 vector reflects a high availability impact, because reliably triggering it requires control over the virtual hardware or NUMA topology, which normally belongs to a hypervisor administrator rather than an ordinary user of the affected system, and the consequence is limited to availability with no memory corruption, information disclosure, or privilege escalation. Within Red Hat's portfolio, the vulnerable code is present only in the RHEL 9.8 and later 9.z streams, the RHEL 10.2 and later 10.z streams, and products built from them (Red Hat In-Vehicle OS 2 and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 using RHEL CoreOS 9). Earlier RHEL 6, 7, 8, and 9 releases, RHEL 10.0, and the Real Time kernel (kernel-rt) builds are not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are currently deferred given the low impact of this flaw; the residual risk is a boot-time kernel crash restricted to virtualized guests whose hypervisor exposes the atypical topology with more nodes than roots.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.