CVE-2026-98157

A flaw was found in the Linux kernel's Error Detection and Correction (EDAC) subsystem. The sysfs interface for device polling improperly validated input values when configuring the polling interval, allowing integer truncation and zero-delay settings. A local user with write permissions to the attribute could exploit this flaw to cause the polling work to spin indefinitely without a delay, leading to excessive CPU utilization and a Denial of Service (DoS).

A flaw of low impact was found in the Linux kernel's Error Detection and Correction (EDAC) subsystem. The sysfs store handler for the device poll_msec attribute in drivers/edac/edac_device_sysfs.c used simple_strtoul(), which parses an unsigned long, while the underlying poll_msec field is an unsigned int. As a result, on 64-bit systems values larger than UINT_MAX were silently truncated, and values smaller than 1, such as 0, were accepted. A local user with write permission to an EDAC device's poll_msec sysfs attribute, which is normally restricted to privileged local users, could set a zero polling delay, causing the EDAC polling work to spin without delay, consume excessive CPU, and cause a local denial of service. Confidentiality and integrity are not affected and the flaw is not network-reachable.

Red Hat Enterprise Linux 7 through 10 (kernel and kernel-rt), Red Hat In-Vehicle OS kernels, and the RHEL CoreOS kernels shipped in OpenShift Container Platform are affected; Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope and no update is planned for it. For the affected products, the fix is deferred: because this is a low-impact local denial of service that requires privileged local access to trigger, it will be addressed in a future scheduled kernel update rather than an immediate security erratum. The residual risk is limited to CPU resource exhaustion by an already-privileged local user. Although the CVSS:3.1 base score is 5.5 (MODERATE), Red Hat rates the impact as LOW because exploitation requires local privileges and only availability is affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.