Buffer Overflow Vulnerability in Linux Kernel Impacts Interrupt Processing

CVE-2026-97503

What is CVE-2026-97503?

A buffer overflow vulnerability exists in the Linux kernel's handling of interrupt directory names for 10-digit interrupt numbers. The current implementation constructs directory names using a fixed-size buffer, which does not account for the maximum length required when the interrupt number exceeds 9 digits. This oversight can lead to potential vulnerabilities when using sparse-IRQ configurations that allow more extensive interrupt numbering. The issue has been addressed by appropriately sizing the buffer for the current decimal representation of interrupt numbers and employing bounded formatting during the creation or removal of proc entries to mitigate risks.

References