# CVE-2026-98919: drm/xe: harden adjust_idledly() against divide-by-zero and overflow


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 23 Oct 2026
- **Updated:** 23 Oct 2026
- **Also known as:** BELL-CVE-2026-98919, DEBIAN-CVE-2026-98919, GHSA-wghv-7vwx-fc47, UBUNTU-CVE-2026-98919

## What is CVE-2026-98919?

CVE-2026-98919 is a vulnerability in Linux, published on 23 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: harden adjust_idledly() against divide-by-zero and overflow

adjust_idledly() has several corner-case issues flagged during review:

  1. If xe_gt_clock_init() failed to recognise the crystal clock,
     gt->info.timestamp_base is 0, which makes idledly_units_ps also 0.
     The subsequent DIV_ROUND_CLOSEST(..., idledly_units_ps) is then a
     divide-by-zero and panics the kernel.

  2. The tick-to-ns conversions are done in u32:
        idledly * idledly_units_ps, (maxcnt - 1) * 1000
     Both overflow u32 before DIV_ROUND_CLOSEST() sees them.

  3. If IDLE_WAIT_TIME reads back as 0, maxcnt evaluates to 0 and
     the maxcnt - 1 clamp wraps to 0xFFFFFFFF in u32.

  4. The register only stores whole ticks, so the clamped ns value has
     to be converted to ticks and back. DIV_ROUND_CLOSEST() can round
     that conversion up past maxcnt:

       maxcnt = 640 ns, one tick = 666664 ps

       clamp:        maxcnt - 1        = 639 ns
       ns -> ticks:  639000 / 666664   = 0.958 -> rounds to 1 tick
       tick -> ns:    1 * 666664 / 1000 = 667 ns

     667 ns is programmed into RING_IDLEDLY, but 667 >= maxcnt (640),
     so xe_gt_WARN_ON() fires again on every subsequent init.

Return early if timestamp_base is 0 (the unknown-crystal path).
Do the conversions in u64 via the *_ULL() helpers so they cannot wrap.
Clamp with a floor (DIV_ROUND_DOWN_ULL) so the programmed delay stays
strictly below maxcnt, and guard the maxcnt == 0 case with a zero delay
while still writing RING_IDLEDLY so INHIBIT_SWITCH_UNTIL_PREEMPTED is
cleared.

v2: Drop the redundant warn on the timestamp_base == 0 path;
    xe_gt_clock_init() already warns on an unrecognised crystal clock.
    Keep the early return to avoid the divide-by-zero. - Vinay

v3: Field-mask the RING_IDLEDLY write with REG_FIELD_PREP(IDLE_DELAY, ...)
    instead of writing the raw tick count, which could clobber
    INHIBIT_SWITCH_UNTIL_PREEMPTED and reserved bits. Split the
    inhibit-switch clear from the maxcnt clamp so a set inhibit bit no
    longer forces a needless delay overwrite when the delay itself is
    already valid. Use gt_to_xe(gt) instead of gt_to_xe(hwe->gt).

(cherry picked from commit d864065ea25e9d12897c175de9176ce46677e176)

## Which versions are affected by CVE-2026-98919?


## How do I fix CVE-2026-98919?

Upgrade to a fixed version.

## Is CVE-2026-98919 being exploited?

There is no known exploitation of CVE-2026-98919 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98919 and fix it if it is affected.

What it is: CVE-2026-98919 is a vulnerability in Linux, published on 23 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-98919 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98919/ (Markdown: https://insights.sbomify.com/CVE-2026-98919/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98919
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98919
- OSV: https://osv.dev/vulnerability/CVE-2026-98919

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98919/
Summaries are generated and may contain mistakes; the official description above is the record.