CVE-2026-98157 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel deployments using the EDAC device sysfs should assess exposure and prioritize remediation. The vulnerability's impact is limited to systems where the poll_msec sysfs store file is used with values that could be truncated.

Why it matters

Defenders should assess exposure and prioritize remediation for Linux kernel deployments using the EDAC device sysfs due to a vulnerability that could cause silent truncation and potential 100% CPU consumption.

• Potential for 100% CPU consumption by the poll work due to 0-delay case
• Silent truncation of values > UINT_MAX on 64-bit systems
• Need for verification of affected systems and versions
• Priority for applying the fix to prevent truncation and potential CPU consumption

Technical summary

The Linux kernel's EDAC device sysfs uses simple_strtoul() for the poll_msec sysfs store file, which accepts an unsigned long. However, the target field (poll_msec) is an unsigned int, causing a mismatch that could lead to silent truncation on 64-bit systems for values > UINT_MAX. The issue is resolved by using kstrtouint() instead, which rejects values larger than UINT_MAX at parse time. A check for value < 1 has also been added to prevent the 0-delay case, which could cause the poll work to spin without delay and consume 100% CPU.

Defensive priority

Defenders should assess exposure and prioritize remediation for Linux kernel deployments using the EDAC device sysfs. The vulnerability's impact is limited to systems where the poll_msec sysfs store file is used with values that could be truncated.

Recommended defensive actions

• Assess exposure of Linux kernel deployments using the EDAC device sysfs
• Verify if the poll_msec sysfs store file is used with values that could be truncated
• Apply the fix by using kstrtouint() instead of simple_strtoul()
• Monitor for potential 100% CPU consumption by the poll work
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the scope of affected systems and versions is not explicitly stated, requiring verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.