CVE-2026-97503 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators should assess exposure and prioritize verification of affected systems, focusing on the /proc/irq/ directory naming issue for 10-digit interrupt numbers. This includes verifying if Linux kernel version is affected by CVE-2026-97503 and applying patch or update kernel if necessary. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and  

Why it matters

CVE-2026-97503 is a Linux kernel vulnerability affecting /proc/irq/ directory naming for 10-digit interrupt numbers. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

• Verify if Linux kernel version is affected by CVE-2026-97503
• Assess exposure of Linux kernel systems to CVE-2026-97503

Technical summary

The Linux kernel vulnerability CVE-2026-97503 is related to the sizing of interrupt directory names for 10-digit interrupt numbers in the /proc/irq/ directory. The current implementation uses a 10-character buffer, which is insufficient for 10-digit IRQ numbers. This issue has been resolved by adjusting the buffer size to accommodate the current decimal form and switching to bounded formatting. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, focusing on the /proc/irq/ directory naming issue for 10-digit interrupt numbers.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems.

Recommended defensive actions

• Assess exposure of Linux kernel systems to CVE-2026-97503
• Verify if the current kernel version is affected
• Apply patch or update kernel if necessary
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its scope and impact require further verification. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, focusing on the /proc/irq/ directory naming issue for 10-digit interrupt numbers. Evidence from the CVE record and NVD entry suggests that the vulnerability has been resolved by adjusting the buffer size to accommodate the current decimal form and switching to bounded formatting. However, the exact scope and  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.