genirq IrqName Overflow

Vulnerability analysis

When the kernel registers or unregisters an interrupt, it formats the interrupt number into a fixed-size character buffer on the stack to create the corresponding /proc/irq directory entry. That buffer is sized for 9-digit numbers, so a 10-digit interrupt number causes the string's terminating NUL byte to overflow one byte past the buffer end, corrupting adjacent stack memory. The fix enlarges the buffer to hold the full range of unsigned interrupt numbers and replaces the unbounded formatting call with a bounded variant that cannot overflow. The vulnerable code path runs during interrupt registration, which is driven by driver and hardware activity rather than by direct userspace requests; a local attacker would need to trigger device operations that cause a 10-digit interrupt allocation, which requires a system configured with sparse IRQs that allow such high numbers.