{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98157", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.320Z", "datePublished": "2026-09-25T10:36:27.009Z", "dateUpdated": "2026-09-25T10:36:27.009Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T10:36:27.009Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation\n\nThe poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned\nlong, but the target field (poll_msec) is unsigned int. On 64-bit systems,\na value > UINT_MAX is silently truncated when stored.\n\nFix the mismatch by using kstrtouint() instead. This rejects values larger\nthan UINT_MAX at parse time, making truncation impossible. Also add a check\nfor value < 1 to reject the 0-delay case, which would cause the poll work to\nspin without delay and consume 100% CPU."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/edac/edac_device_sysfs.c"], "versions": [{"version": "e27e3dac651771fe3250f6305dee277bce29fc5d", "lessThan": "ea01c061d839b520f385f112908de1c6e3391327", "status": "affected", "versionType": "git"}, {"version": "e27e3dac651771fe3250f6305dee277bce29fc5d", "lessThan": "528052af901d6e6bbfa0e52362a70a58a5dd1e43", "status": "affected", "versionType": "git"}, {"version": "e27e3dac651771fe3250f6305dee277bce29fc5d", "lessThan": "0e022ee4f8e0dc843ba4c80bb75408a7704279af", "status": "affected", "versionType": "git"}, {"version": "e27e3dac651771fe3250f6305dee277bce29fc5d", "lessThan": "66cc9dec919dd63d8e4b3d386f7aed3ae684e645", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/edac/edac_device_sysfs.c"], "versions": [{"version": "2.6.23", "status": "affected"}, {"version": "0", "lessThan": "2.6.23", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23", "versionEndExcluding": "7.3-rc2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ea01c061d839b520f385f112908de1c6e3391327"}, {"url": "https://git.kernel.org/stable/c/528052af901d6e6bbfa0e52362a70a58a5dd1e43"}, {"url": "https://git.kernel.org/stable/c/0e022ee4f8e0dc843ba4c80bb75408a7704279af"}, {"url": "https://git.kernel.org/stable/c/66cc9dec919dd63d8e4b3d386f7aed3ae684e645"}], "title": "EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/edac/edac_device_sysfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ea01c061d839b520f385f112908de1c6e3391327", "status": "affected", "version": "e27e3dac651771fe3250f6305dee277bce29fc5d", "versionType": "git"}, {"lessThan": "528052af901d6e6bbfa0e52362a70a58a5dd1e43", "status": "affected", "version": "e27e3dac651771fe3250f6305dee277bce29fc5d", "versionType": "git"}, {"lessThan": "0e022ee4f8e0dc843ba4c80bb75408a7704279af", "status": "affected", "version": "e27e3dac651771fe3250f6305dee277bce29fc5d", "versionType": "git"}, {"lessThan": "66cc9dec919dd63d8e4b3d386f7aed3ae684e645", "status": "affected", "version": "e27e3dac651771fe3250f6305dee277bce29fc5d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/edac/edac_device_sysfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.23"}, {"lessThan": "2.6.23", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation\n\nThe poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned\nlong, but the target field (poll_msec) is unsigned int. On 64-bit systems,\na value > UINT_MAX is silently truncated when stored.\n\nFix the mismatch by using kstrtouint() instead. This rejects values larger\nthan UINT_MAX at parse time, making truncation impossible. Also add a check\nfor value < 1 to reject the 0-delay case, which would cause the poll work to\nspin without delay and consume 100% CPU."}], "id": "CVE-2026-98157", "lastModified": "2026-09-25T11:17:47.397", "metrics": {}, "published": "2026-09-25T11:17:47.397", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e022ee4f8e0dc843ba4c80bb75408a7704279af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/528052af901d6e6bbfa0e52362a70a58a5dd1e43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/66cc9dec919dd63d8e4b3d386f7aed3ae684e645"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea01c061d839b520f385f112908de1c6e3391327"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation", "id": "2541346", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541346"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-681", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nEDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation\nThe poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned\nlong, but the target field (poll_msec) is unsigned int. On 64-bit systems,\na value > UINT_MAX is silently truncated when stored.\nFix the mismatch by using kstrtouint() instead. This rejects values larger\nthan UINT_MAX at parse time, making truncation impossible. Also add a check\nfor value < 1 to reject the 0-delay case, which would cause the poll work to\nspin without delay and consume 100% CPU.", "A flaw was found in the Linux kernel's Error Detection and Correction (EDAC) subsystem. The sysfs interface for device polling improperly validated input values when configuring the polling interval, allowing integer truncation and zero-delay settings. A local user with write permissions to the attribute could exploit this flaw to cause the polling work to spin indefinitely without a delay, leading to excessive CPU utilization and a Denial of Service (DoS)."], "name": "CVE-2026-98157", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98157\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98157\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98157.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e27e3dac651771fe3250f6305dee277bce29fc5d,ea01c061d839b520f385f112908de1c6e3391327)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e27e3dac651771fe3250f6305dee277bce29fc5d,528052af901d6e6bbfa0e52362a70a58a5dd1e43)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e27e3dac651771fe3250f6305dee277bce29fc5d,0e022ee4f8e0dc843ba4c80bb75408a7704279af)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e27e3dac651771fe3250f6305dee277bce29fc5d,66cc9dec919dd63d8e4b3d386f7aed3ae684e645)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.23"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.23)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T12:15:16.539044+00:00", "updated": "2026-09-25T14:13:36.612094+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-190", "CWE-399"]}