CVE-2026-72067

Received Received - Intake

Linux Kernel CPU Hotplug Callback Error Handling Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhp_invoke_callback() unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the original error and make the failed transition look successful. Keep the rollback result separate from the original error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72067

EUVD

EUVD-2026-59025

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's CPU hotplug functionality. When a CPU hotplug operation fails, the system attempts to roll back previous successful operations. However, the rollback process incorrectly reuses the original error code, which can mask the failure and make the entire operation appear successful even though it failed.

Detection Guidance

This vulnerability is specific to the Linux kernel's CPU hotplug functionality and may not have direct detection commands. Monitor kernel logs for CPU hotplug errors or failures during state transitions. Check dmesg or journalctl for messages related to cpuhp or hotplug operations.

Impact Analysis

This could lead to system instability or incorrect CPU state management. If a CPU hotplug operation fails but appears successful, the system might operate with fewer CPUs than intended, causing performance issues or unexpected behavior in critical workloads.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to Linux kernel CPU hotplug functionality and does not involve data handling, privacy, or security controls typically regulated by these standards.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this issue. If a patch is not yet available, avoid unnecessary CPU hotplug operations until the fix is applied. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-72067. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70