Riskcovery

CVE-2026-97503

genirq/proc: Size interrupt directory names for 10-digit interrupt numbers

State
Published
Severity
Not scored
Published
Sep 24, 2026
Updated
Oct 21, 2026
Reserved
Sep 24, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

genirq/proc: Size interrupt directory names for 10-digit interrupt numbers

/proc/irq/<n>/ directory names are built in `char name[10]` buffers with `sprintf(name, "%u", irq)`.

Ten-digit IRQ numbers already need 11 bytes including the trailing NUL, and current sparse-IRQ configurations allow interrupt numbers in that range.

Size the temporary name buffer for the current decimal form and switch to bounded formatting when creating or removing the proc entry.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 721255b9826bd11c7a38b585905fc2dd0fb94e52 to before a8adf64fe7fd5d7c476769a043ee56eda7b775ceAffected
  • 721255b9826bd11c7a38b585905fc2dd0fb94e52 to before 488bcd7fd3e9a2ad647b71b505a269fdb28753c4Affected
  • 721255b9826bd11c7a38b585905fc2dd0fb94e52 to before d4b22fbae70037299e96539c330e4a1054b28a91Affected
  • 721255b9826bd11c7a38b585905fc2dd0fb94e52 to before c2c7983c93f5d86962318be7e7298f1bc3feb1a6Affected
LinuxLinux
  • 6.5Affected
  • before 6.5Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.