CVE-2026-98157: Linux Kernel EDAC Device Sysfs DOS Vulnerability

CVE-2026-98157 Overview

CVE-2026-98157 is a Linux kernel vulnerability in the Error Detection and Correction (EDAC) device sysfs interface. The poll_msec store handler parsed user input with simple_strtoul(), which returns an unsigned long, while the backing field is an unsigned int. On 64-bit systems, values greater than UINT_MAX are silently truncated during assignment. The handler also accepted a value of 0, which would cause the polling work queue to spin without delay and saturate a CPU core. Maintainers resolved the issue by switching to kstrtouint() and adding a lower-bound check that rejects values below 1.

Critical Impact
A local user with write access to the EDAC poll_msec sysfs file can cause silent value truncation or trigger 100% CPU consumption by the EDAC polling work.

Affected Products

Linux kernel (EDAC device sysfs subsystem)
64-bit Linux distributions shipping affected kernel builds
Systems exposing /sys/devices/system/edac/.../poll_msec

Discovery Timeline

2026-09-25 - CVE-2026-98157 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98157

Vulnerability Analysis

The defect is a numeric truncation and input validation issue in the EDAC device sysfs layer. The poll_msec store callback converted user-supplied strings using simple_strtoul(), producing an unsigned long result. The destination field holds the polling interval as an unsigned int. On 64-bit kernels, writing a value larger than UINT_MAX succeeds but the stored interval is silently truncated to the low 32 bits.

In addition, the handler did not enforce a minimum interval. Writing 0 to poll_msec scheduled the polling work with no delay, causing the kernel worker to execute continuously and consume an entire CPU core. The combination weakens administrative control over hardware error polling cadence and provides a trivial local resource exhaustion primitive.

The fix replaces simple_strtoul() with kstrtouint(), which rejects out-of-range values at parse time, and adds an explicit check rejecting values less than 1. The EPSS score for this issue is 0.157%.

Root Cause

The root cause is a type-width mismatch between the parser and the target variable, combined with missing lower-bound validation. simple_strtoul() returns unsigned long and does not report overflow relative to a narrower destination type, so the assignment into an unsigned int field truncates silently on LP64 systems.

Attack Vector

Exploitation requires local access and permission to write the EDAC poll_msec sysfs attribute, which is normally restricted to privileged users. An attacker meeting those preconditions can either submit a value above UINT_MAX to obtain an unintended polling interval or write 0 to force the polling work to spin without delay. Technical details are available in the upstream commits: kernel commit 528052af, kernel commit 0e022ee4, kernel commit 66cc9dec, and kernel commit ea01c061.

Detection Methods for CVE-2026-98157

Indicators of Compromise

Sustained 100% CPU utilization attributed to an EDAC polling kernel worker thread.
Unexpected writes to /sys/devices/system/edac/mc/.../poll_msec recorded in audit logs.
EDAC polling intervals observed in /sys that do not match configured management values.

Detection Strategies

Audit kernel versions against the fixed commits referenced in the upstream advisories to confirm patch status.
Enable the Linux Audit subsystem to log write operations against EDAC sysfs attributes under /sys/devices/system/edac/.
Correlate anomalous per-CPU utilization by kernel worker threads with recent sysfs modifications.

Monitoring Recommendations

Alert on sustained single-core saturation by kworker threads associated with EDAC polling.
Track configuration drift of EDAC poll_msec values across the fleet and compare against a known baseline.
Monitor privileged shell activity targeting /sys/devices/system/edac/ paths.

How to Mitigate CVE-2026-98157

Immediate Actions Required

Inventory running kernels and identify hosts without the fix from the upstream stable commits.
Apply vendor-provided kernel updates that incorporate the kstrtouint() conversion and the < 1 rejection check.
Restrict write access to EDAC sysfs attributes to trusted administrative accounts only.

Patch Information

The upstream fix replaces simple_strtoul() with kstrtouint() in the EDAC device sysfs poll_msec store path and rejects values less than 1. Patches are available in the stable tree via kernel commit 528052af, kernel commit 0e022ee4, kernel commit 66cc9dec, and kernel commit ea01c061. Rebuild and reboot into the patched kernel to activate the fix.

Workarounds

Tighten filesystem permissions on EDAC sysfs attributes so only root can write poll_msec.
Use Mandatory Access Control policies (SELinux or AppArmor) to confine processes able to modify EDAC sysfs entries.
Document and enforce a validated poll_msec range through configuration management until the kernel patch is deployed.

bash

# Configuration example: inspect current poll_msec values and permissions
for f in /sys/devices/system/edac/mc/mc*/poll_msec; do
    echo "$f = $(cat "$f")"
    stat -c '%a %U:%G %n' "$f"
done