CVE-2026-97503 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
/proc/irq/<n>/ directory names are built in `char name[10]` buffers
with `sprintf(name, "%u", irq)`.
Ten-digit IRQ numbers already need 11 bytes including the trailing NUL, and current sparse-IRQ configurations allow interrupt numbers in that range.
Size the temporary name buffer for the current decimal form and switch to bounded formatting when creating or removing the proc entry.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel contains a stack-based buffer overflow vulnerability within the generic interrupt handling subsystem, specifically affecting the creation of process file system entries for interrupts. This flaw originates in the genirq/proc module where directory names corresponding to specific interrupt request lines are constructed using fixed-size character buffers declared as char name[10]. The code utilizes sprintf to format the integer identifier of the interrupt into this buffer without performing any bounds checking or length validation prior to writing. While ten-digit decimal numbers theoretically require eleven bytes for storage including the null terminator, the allocated buffer only provides space for exactly ten characters plus one byte for termination if strictly limited, but in practice, a number requiring eleven digits will overflow the boundary of the ten-byte array when sprintf writes the full string and its terminating NUL character.
This vulnerability is particularly relevant under sparse-IRQ configurations where interrupt numbers can reach values that necessitate more than nine decimal digits. When an interrupt identifier exceeds ninety-nine million, the resulting formatted name requires eleven bytes to be stored correctly in memory. Because the buffer size remains fixed at ten characters during this operation, the sprintf function writes beyond the allocated stack space, corrupting adjacent memory locations on the kernel stack. This out-of-bounds write constitutes a classic CWE-120 Buffer Copy without Checking Size of Input condition, which can lead to unpredictable behavior depending on what data resides in the neighboring stack frames or control structures.
The operational impact of this vulnerability is significant as it allows for potential privilege escalation and system instability. An attacker who can trigger the creation of an interrupt entry with a high-numbered identifier may overwrite critical kernel stack variables, potentially altering return addresses or function pointers. This could facilitate arbitrary code execution within the kernel context, granting full control over the operating system. Furthermore, even without successful exploitation for code execution, such memory corruption often results in immediate kernel panics and system crashes due to invalid memory access or corrupted data structures during subsequent interrupt handling operations.
Mitigation strategies primarily involve applying vendor-provided security patches that update the genirq/proc module to use bounded formatting functions like snprintf instead of sprintf. This ensures that no more than nine characters are written into the ten-byte buffer, preserving space for the null terminator and preventing stack overflow. Additionally, increasing the size of the temporary name buffer to accommodate eleven bytes would also resolve the immediate memory corruption issue by providing sufficient storage for larger interrupt identifiers. System administrators should ensure their kernels are updated to versions where this boundary check is enforced or the buffer allocation is dynamically sized based on the maximum expected length of the decimal representation of the interrupt number, aligning with secure coding standards that mandate explicit size limits in all string formatting operations.