Medium 5.5Published May 28, 2026

CVE-2026-46161md/raid10: fix divide-by-zero in setup_geo() with zero far_copies

Updated under an hour ago (Oct 26, 2026, 1:40 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setup_geo() with zero far_copies setup_geo() extracts near_copies (nc) and far_copies (fc) from the user-provided layout parameter without checking for zero. When fc=0 with the "improved" far set layout selected, 'geo->far_set_size = disks / fc' triggers a divide-by-zero. Validate nc and fc immediately after extraction, returning -1 if either is zero.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	475901aff15841fb0a81e7546517407779a9b061 builds before 0b43a70394ce492274e67463326be03e0a9897c5; from 475901aff15841fb0a81e7546517407779a9b061 before c716ab3034f84f8a6c226814247b8c5ac9f95da1; 475901aff15841fb0a81e7546517407779a9b061 builds before 553e32adfa1a96b217651139a3f8c3b92b9984ac; 475901aff15841fb0a81e7546517407779a9b061 builds before 4af2e558e6fdfb972c61350653fd55d1f62b60a5; 475901aff15841fb0a81e7546517407779a9b061 builds before 9d8e03b9a2b1e8ce5c198bf3a409a629f4d02cda; 475901aff15841fb0a81e7546517407779a9b061 builds before 913d556e4bd1b56ed822815655b82c7bb54edc51; from 475901aff15841fb0a81e7546517407779a9b061 before f9ddb621b2325eb69c95692958daf2bab4dea2c4; 475901aff15841fb0a81e7546517407779a9b061 builds before 9aa6d860b0930e2f72795665c42c44252a558a0c	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.9.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7; 3.9; and 8 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0b43a70394ce492274e67463326be03e0a9897c5	patch
https://git.kernel.org/stable/c/c716ab3034f84f8a6c226814247b8c5ac9f95da1	patch
https://git.kernel.org/stable/c/553e32adfa1a96b217651139a3f8c3b92b9984ac	patch
https://git.kernel.org/stable/c/4af2e558e6fdfb972c61350653fd55d1f62b60a5	patch
https://git.kernel.org/stable/c/9d8e03b9a2b1e8ce5c198bf3a409a629f4d02cda	patch
https://git.kernel.org/stable/c/913d556e4bd1b56ed822815655b82c7bb54edc51	patch
https://git.kernel.org/stable/c/f9ddb621b2325eb69c95692958daf2bab4dea2c4	patch
https://git.kernel.org/stable/c/9aa6d860b0930e2f72795665c42c44252a558a0c	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.