CVE-2026-98157

A flaw of low impact was found in the Linux kernel's Error Detection and Correction (EDAC) subsystem. The sysfs store handler for the device poll_msec attribute in drivers/edac/edac_device_sysfs.c used simple_strtoul(), which parses an unsigned long, while the underlying poll_msec field is an unsigned int. As a result, on 64-bit systems values larger than UINT_MAX were silently truncated, and values smaller than 1, such as 0, were accepted. A local user with write permission to an EDAC device's poll_msec sysfs attribute, which is normally restricted to privileged local users, could set a zero polling delay, causing the EDAC polling work to spin without delay, consume excessive CPU, and cause a local denial of service. Confidentiality and integrity are not affected and the flaw is not network-reachable.

Red Hat Enterprise Linux 7 through 10 (kernel and kernel-rt), Red Hat In-Vehicle OS kernels, and the RHEL CoreOS kernels shipped in OpenShift Container Platform are affected; Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope and no update is planned for it. For the affected products, the fix is deferred: because this is a low-impact local denial of service that requires privileged local access to trigger, it will be addressed in a future scheduled kernel update rather than an immediate security erratum. The residual risk is limited to CPU resource exhaustion by an already-privileged local user. Although the CVSS:3.1 base score is 5.5 (MODERATE), Red Hat rates the impact as LOW because exploitation requires local privileges and only availability is affected.