CVE-2026-97503: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running a Linux kernel with sparse IRQ configurations that can allocate 10-digit interrupt numbers are exposed. The overflow occurs while creating or removing the corresponding /proc/irq/<n>/ entry.
What condition is needed to trigger the overflow?
An interrupt number large enough to require 10 decimal digits must be used. Formatting that IRQ number into the fixed 10-byte temporary buffer leaves no space for the terminating NUL byte.
How can I tell whether a system may be affected?
Check whether the running kernel includes the referenced stable fixes and whether its configuration permits sparse IRQ allocation in the 10-digit range. Inspecting /proc/irq entries may help identify currently allocated IRQ numbers, but the issue depends on reaching a 10-digit IRQ value during proc entry creation or removal.