Truncation Vulnerability in Linux Kernel Affecting Polling Mechanism

CVE-2026-98157

What is CVE-2026-98157?

A vulnerability within the Linux kernel concerns the poll_msec sysfs store file, which previously used simple_strtoul() for value parsing, leading to potential truncation of values larger than UINT_MAX. On 64-bit systems, values exceeding this limit could be silently truncated, causing unintended behavior. The issue is addressed by replacing simple_strtoul() with kstrtouint(), enabling the rejection of values that exceed UINT_MAX at the parsing stage. Additionally, a safeguard against a zero-delay value has been implemented to prevent excessive CPU usage from continuous polling without delay.

References