Linux Kernel EUVD-2026-86988

Exploitation requires local access to a system running an affected Linux kernel and the ability to write to the EDAC device's 'poll_msec' sysfs attribute (under the EDAC device sysfs path). The concrete trigger is writing a 0-delay value - or, on 64-bit systems, a value larger than UINT_MAX that silently truncated under the old simple_strtoul() parsing - which makes the EDAC poll work item spin without delay. Limiting factors that reduce real-world risk: the attack is local only (no network vector), it affects only systems where the EDAC subsystem is active and exposes this device sysfs interface, and in practice the poll_msec sysfs file is root-writable, so an unprivileged user typically cannot reach it despite the input's PR:L rating.

This is a low-to-moderate priority, local-only availability bug, not a high-impact security issue despite the A:H component. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local, low-complexity, privileged-but-non-interactive attack with impact limited purely to availability - no confidentiality or integrity loss. All exploitation signals point the same way and are consistent: EPSS is 0.16% (4th percentile), there is NO CISA KEV listing, and NO public exploit code is referenced, so there is no public exploit identified at time of analysis. The low EPSS aligns with the local-access requirement and niche attack surface (the EDAC device sysfs interface), indicating this is realistically a stability/hardening fix rather than an actively targeted vulnerability. One notable discrepancy: the input CVSS uses PR:L, but writing to the EDAC poll_msec sysfs attribute normally requires root (sysfs attributes are typically root-writable), so the practical privilege barrier is likely higher than PR:L suggests - verify the actual sysfs file permissions in your deployment. Additionally, the 'Information Disclosure' tag conflicts with the CVSS impact profile (C:N/I:N/A:H), which is pure availability; this tag appears mislabeled. Net assessment: deploy the patch through normal kernel update cycles; this does not warrant emergency out-of-band patching.

A local user with the ability to write to the EDAC device's poll_msec sysfs attribute writes a value of 0 (or, on 64-bit systems, a value above UINT_MAX that truncates toward a very small number), causing the EDAC polling work item to re-queue with no delay. The poll work then spins continuously, consuming 100% of a CPU and degrading system availability. No public exploit code is identified at time of analysis, and exploitation requires local privileged access rather than remote reach.