Cloudanix VulnDB

CVE-2026-98157

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A local user on certain Linux systems can write a special value that makes a hardware-monitoring feature run without pause and use up all the CPU.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The poll_msec sysfs handler in EDAC uses simple_strtoul() (unsigned long) to write an unsigned int field, allowing silent truncation of values > UINT_MAX on 64-bit systems and permitting a zero value that causes the poll workqueue to spin at 100% CPU.

Why it matters to the business

Local users can trigger high CPU consumption or service degradation on affected Linux systems by writing crafted values to an EDAC sysfs attribute, increasing operational cost and availability risk until the kernel is updated.

How an attack unfolds

An attacker with local access locates the EDAC poll_msec sysfs file, writes a value larger than UINT_MAX or exactly zero, and observes either silent truncation or immediate CPU spin in the poll work item, achieving a local denial-of-service condition.

How to fix it

Upgrade the Linux kernel to a version containing the kstrtouint() replacement and the added value < 1 rejection check; apply the fix from the mainline commit that resolves the truncation and zero-delay issues.

How to confirm the fix worked

Confirm the running kernel contains the kstrtouint() change; attempt to write values > UINT_MAX and 0 to poll_msec and verify both are rejected; monitor that poll work does not consume 100% CPU under normal EDAC operation.

Typical attack path

  1. Obtain local shell or unprivileged process on target Linux system
  2. Locate the EDAC device sysfs directory containing poll_msec
  3. Write a value > UINT_MAX or 0 to the poll_msec attribute
  4. Observe CPU consumption or continued operation under truncated value

How to detect it

Search kernel or audit logs for writes to EDAC poll_msec sysfs paths; look for processes or workqueues showing sustained 100% CPU with no corresponding hardware events; review any custom monitoring that records sysfs attribute changes.

  • /sys/devices/system/edac/*/poll_msec
  • simple_strtoul
  • edac.*poll.*100%

What your security team should do

  • Patch affected Linux kernels to the fixed release containing the kstrtouint() change as soon as vendor packages are available
  • Restrict local write access to EDAC sysfs files via file permissions or SELinux/AppArmor policy where possible
  • Monitor systems for sustained high CPU usage attributable to EDAC poll work

The record

In the Linux kernel, the following vulnerability has been resolved: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation The poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned long, but the target field (poll_msec) is unsigned int. On 64-bit systems, a value > UINT_MAX is silently truncated when stored. Fix the mismatch by using kstrtouint() instead. This rejects values larger than UINT_MAX at parse time, making truncation impossible. Also add a check for value < 1 to reject the 0-delay case, which would cause the poll work to spin without delay and consume 100% CPU.

Affected packages

Ecosystem Package Introduced Fixed