{"id":"AZL-104808","summary":"CVE-2026-98157 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation\n\nThe poll_msec sysfs store file uses simple_strtoul() which accepts an unsigned\nlong, but the target field (poll_msec) is unsigned int. On 64-bit systems,\na value \u003e UINT_MAX is silently truncated when stored.\n\nFix the mismatch by using kstrtouint() instead. This rejects values larger\nthan UINT_MAX at parse time, making truncation impossible. Also add a check\nfor value \u003c 1 to reject the 0-delay case, which would cause the poll work to\nspin without delay and consume 100% CPU.","modified":"2026-09-26T14:16:05.973190822Z","published":"2026-09-25T11:17:47Z","upstream":["CVE-2026-98157"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98157"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-104808.json"}}],"schema_version":"1.9.0"}