CVE-2026-72394 hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero
A divide-by-zero error in the Aspeed G6 PWM tachometer driver causes a kernel panic when hardware reports a zero tachometer value.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72394?
CVE-2026-72394 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero
Sashiko reports:
In the aspeed-g6-pwm-tacho driver, the aspeed_tach_val_to_rpm() function calculates the fan RPM using the tachometer value. However, it does not check if the tachometer value is zero before performing the division.
If the hardware reports a tachometer value of 0 (which can happen due to an extremely fast pulse, a stuck edge, or a hardware glitch), the calculated tach_div evaluates to 0. The subsequent call to do_div() with tach_div as the divisor triggers a divide-by-zero exception, leading to a kernel panic.
Check the divisor against zero to fix the problem.
Which versions are affected by CVE-2026-72394?
How do I fix CVE-2026-72394?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72394 being exploited?
There is no known exploitation of CVE-2026-72394 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72394, DEBIAN-CVE-2026-72394, GHSA-3hcm-7xpr-63qg, UBUNTU-CVE-2026-72394.