CVE-2026-72010

Received Received - Intake

Linux Kernel Memory Policy Rebind Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a CPU hotplug event. Reproduction steps: 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems) 2) Move the task into the child cpuset 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES 4) unplug and hotplug a cpu echo 0 > /sys/devices/system/cpu/cpu1/online echo 1 > /sys/devices/system/cpu/cpu1/online 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the call to __nodes_fold() The cpuset code passes (cs->mems_allowed) which is not guaranteed to have nodes to the rebind routine. Use cs->effective_mems instead, which is guaranteed to have a non-empty nodemask once we reach that code path. [ david: add a comment, slightly rephrase description ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72010

EUVD

EUVD-2026-59109

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel occurs when a child cpuset is created without setting cpuset.mems. If a task in this cpuset has a VMA mempolicy with MPOL_F_RELATIVE_NODES, a division by zero error can happen during a CPU hotplug event. The issue arises because the cpuset code passes mems_allowed instead of effective_mems to the rebind routine, which may not have nodes.

Detection Guidance

This vulnerability is specific to the Linux kernel's cgroup/cpuset functionality and may not have direct network detection methods. Check kernel logs for division by zero errors or crashes related to cpuset or mempolicy operations. Monitor for system instability during CPU hotplug events.

Impact Analysis

This vulnerability can cause a system crash due to a division by zero error during CPU hotplug events. If exploited, it may lead to denial of service, system instability, or potential privilege escalation in affected Linux systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue causing a division by zero error in memory policy handling during CPU hotplug events, which could lead to system instability or crashes. Compliance impacts would only occur if this vulnerability were exploited to cause data breaches or system failures affecting protected data.

Mitigation Strategies

Apply the latest Linux kernel security patches. Avoid creating child cpusets without setting cpuset.mems. Review and update mempolicy configurations to prevent MPOL_F_RELATIVE_NODES usage in problematic scenarios. Monitor system logs for related errors.

Hi! I’m here to help you understand CVE-2026-72010. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70