CVE-2026-98157
Analyzed
Analyzed - Analysis Complete
EDAC/device_sysfs poll_msec Truncation Fix in Linux Kernel
Vulnerability report for CVE-2026-98157, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-25
Last updated on: 2026-10-20
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
The poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned
long, but the target field (poll_msec) is unsigned int. On 64-bit systems,
a value > UINT_MAX is silently truncated when stored.
Fix the mismatch by using kstrtouint() instead. This rejects values larger
than UINT_MAX at parse time, making truncation impossible. Also add a check
for value < 1 to reject the 0-delay case, which would cause the poll work to
spin without delay and consume 100% CPU.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.19 (inc) to 7.2.7 (exc) |
| linux | linux_kernel | 7.3 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.53 (exc) |
| linux | linux_kernel | From 6.12 (inc) to 6.12.111 (exc) |
| linux | linux_kernel | From 6.6 (inc) to 6.6.158 (exc) |
| linux | linux_kernel | From 6.1 (inc) to 6.1.189 (exc) |
| linux | linux_kernel | From 2.6.23 (inc) to 5.10.271 (exc) |
| linux | linux_kernel | From 5.15 (inc) to 5.15.222 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
