CVE-2026-72172

Received Received - Intake

Memory Corruption in Linux Kernel mm_init

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap. However, compound_nr_pages() still assumes that vmemmap optimization is in effect and initializes only the reduced number of struct pages. As a result, the remaining tail struct pages are left uninitialized, which can later lead to unexpected behavior or crashes. Fix this by treating early sections as unoptimized when calculating how many struct pages to initialize.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72172

EUVD

EUVD-2026-58930

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper initialization of struct pages when DAX memory is hotplugged into an unoccupied subsection of an early section. The issue occurs because section_activate() reuses an unoptimized boot memmap while compound_nr_pages() assumes vmemmap optimization is active, leading to uninitialized tail struct pages that may cause unexpected behavior or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's memory management and requires kernel-level inspection. Detection involves checking kernel logs for memory initialization errors or crashes related to ZONE_DEVICE memory handling. Use dmesg or journalctl to review kernel logs for warnings about uninitialized struct pages or memory corruption.

Impact Analysis

This vulnerability could lead to system instability, crashes, or unexpected behavior when DAX memory is hotplugged. Users relying on such memory configurations may experience data corruption, performance issues, or kernel panics.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level memory management issue in the Linux kernel that could lead to system instability or crashes if exploited. Compliance impacts would only occur indirectly if such failures disrupt data processing or storage systems subject to these regulations.

Mitigation Strategies

Apply the Linux kernel patch that fixes the uninitialized struct pages issue for ZONE_DEVICE. Ensure your system uses a kernel version with the fix applied. Monitor for crashes or unexpected behavior related to memory handling.

Hi! I’m here to help you understand CVE-2026-72172. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70