CVE-2026-98434 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
sysctl: Check range in proc_dointvec_ms_jiffies_minmax
Add the range check to do_proc_int_conv_ms_jiffies_minmax that commit d174174c6776 ("sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions") incorrectly removed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel vulnerability identified in this advisory relates to a regression introduced during the refactoring of sysctl integer conversion logic, specifically within the proc_dointvec_ms_jiffies_minmax function. This issue stems from commit d174174c6776, which replaced the SYSCTL_INT_CONV_CUSTOM macro with dedicated functions to improve code clarity and maintainability. However, this transformation inadvertently omitted a critical range validation check that was previously present in the original implementation. The proc_dointvec_ms_jiffies_minmax function is responsible for handling sysctl entries where values are stored as milliseconds but converted internally to jiffies, which are kernel time units dependent on system configuration. Without proper bounds checking, user-space applications can supply integer values that fall outside acceptable limits, leading to potential data corruption or unexpected kernel behavior.
From a technical perspective, the absence of range validation allows for out-of-bounds writes when these unchecked values are processed further down the sysctl handling pipeline. This flaw aligns with CWE-20 Improper Input Validation and CWE-787 Out-of-bounds Write if the invalid value triggers memory access violations or corrupts kernel data structures. The vulnerability is exploitable by local users who have write permissions to affected /proc/sys entries, enabling them to manipulate system parameters in unintended ways. Depending on the specific sysctl entry involved, this could lead to denial of service conditions through resource exhaustion or instability, and potentially privilege escalation if the corrupted state affects security-critical kernel subsystems such as network stack timers or scheduling mechanisms.
The operational impact centers on the integrity of time-sensitive operations within the Linux kernel. Since jiffies are fundamental to many timing-related functions including process scheduling, timeout handling, and interrupt management, incorrect values can cause system hangs, delayed responses, or crashes. Attackers leveraging this flaw could destabilize affected systems by repeatedly submitting malformed inputs via sysctl interfaces, effectively creating a local denial of service vector. While remote exploitation is unlikely due to the nature of sysctl access requiring prior authentication and file permissions, the ease of triggering makes it a significant concern for environments where unprivileged users have control over certain kernel parameters.
Mitigation strategies primarily involve applying vendor-provided patches that restore the missing range checks in proc_dointvec_ms_jiffies_minmax. System administrators should ensure their kernels are updated to versions containing this fix and monitor sysctl usage patterns for anomalies indicative of exploitation attempts. Additionally, restricting write access to sensitive /proc/sys entries through proper file permissions can reduce exposure until patching is completed. Security teams should also review configurations involving millisecond-to-jiffies conversions in custom kernel modules or third-party drivers that may rely on similar conversion logic without adequate validation.
This vulnerability highlights the importance of rigorous code reviews during refactoring efforts, particularly when replacing macros with functions to preserve security-critical checks. The ATT&CK framework categorizes such issues under T1053 Scheduled Task/Job as a potential persistence mechanism if exploited for long-term system manipulation, though more directly it falls under privilege escalation techniques involving kernel exploitation vectors like T1068 Exploitation for Privilege Escalation. Organizations must maintain up-to-date vulnerability databases and apply patches promptly to mitigate risks associated with these types of input validation regressions in core operating system components.