CVE-2026-97503

A flaw was found in the Linux kernel. This vulnerability can lead to a Denial of Service (DoS) or memory corruption due to a stack-based buffer overflow in the interrupt proc filesystem interface. When creating or removing directory entries for interrupt requests, the temporary buffer is too small to accommodate ten-digit numbers along with their terminating null byte, which can be triggered during the registration of large interrupt numbers.

A low severity flaw was found in the Linux kernel's genirq procfs interface. When creating or removing /proc/irq/<n>/ directory entries, the kernel formats the interrupt number with sprintf() into a 10-byte stack buffer, but a ten-digit IRQ number requires 11 bytes including the trailing NUL byte. On sparse-IRQ configurations that allocate interrupt numbers in that range, this causes a one-byte out-of-bounds NUL write on the kernel stack, which can corrupt adjacent stack data and lead to kernel memory corruption or a kernel crash, that is, a local denial of service. Reliable exploitation requires privileged local control over device and interrupt allocation together with an unusual sparse-IRQ configuration that assigns ten-digit interrupt numbers, so the practical impact is limited to local denial of service.

The vulnerable code is present in the kernel shipped in Red Hat Enterprise Linux 9.8, 9.9, and 9.10, Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built from affected RHEL 9 kernels (4.22, 4.23, and 5.x via ose-rhel-coreos-9). Red Hat Enterprise Linux 6, 7, and 8, the earlier RHEL 9 minor streams, kernel-rt, and earlier OpenShift Container Platform releases are not affected because the vulnerable code is not present in those kernels. The fix is deferred on the affected streams because of the low severity of the flaw and the narrow conditions required to reach the affected code path; the residual risk is a possible local denial of service through the one-byte stack overwrite. Red Hat rates the impact of this flaw as Low even though the CVSS:3.1 base score is 5.5 (Moderate), because triggering the overflow requires privileged local access and a sparse-IRQ configuration that allocates ten-digit interrupt numbers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.