Look up another CVE · open CVE-2026-72066 in the interactive tracker
CVE-2026-72066
cpu: hotplug: Bound hotplug states sysfs output
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem kernel. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72066 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
states_show() adds CPU hotplug state names into a single sysfs buffer using sprintf(). With enough registered states, this can write past the end of the PAGE_SIZE buffer. Use sysfs_emit_at() so output is bounded.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/cpu.c
- What this is
- CPU HOTPLUGMAINTAINERS section matched on kernel/cpu.c · linux-kernel@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- kernel
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.6 | 5.10.265 | 27481cf4365a |
| 4.6 | 5.15.212 | 2408be459c70 |
| 4.6 | 6.1.178 | de4d3d8ae17d |
| 4.6 | 6.6.145 | 998f66e9ce32 |
| 4.6 | 6.12.97 | 61a73a123ac7 |
| 4.6 | 6.18.40 | 6cb15b81ff54 |
| 4.6 | 7.1.5 | 631d53102da9 |
| 4.6 | 7.2 | 86f436567f25 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is in states_show() on the read path for /sys/devices/system/cpu/hotplug/states, reached only via a local sysfs/VFS read() syscall. No network packet handler, adjacent protocol, or physical attach path invokes this CPU hotplug sysfs callback.
- AC:LAttack complexity, low
- Once enough CPU hotplug states are registered (plausible on cloud servers, KVM hosts, Android, and heavily configured distros with hundreds of cpuhp_setup_state() users), a single read deterministically executes unbounded sprintf() past the PAGE_SIZE buffer with no race or attacker-uncontrollable timing.
- PR:LPrivileges required, low
- states is DEVICE_ATTR_RO (mode 0444), so any unprivileged local user can open and read /sys/devices/system/cpu/hotplug/states. states_show() performs no capability, namespace, or credential check before formatting output into the sysfs buffer.
- UI:NUser interaction, none
- Exploitation requires only the attacker reading the sysfs attribute; no victim mount, driver bind, module load, or other interactive action is needed beyond the attacker's own read once sufficient hotplug states exist at boot.
- S:UScope, unchanged
- The out-of-bounds write corrupts kernel heap memory within the same OS/kernel security authority. This is standard kernel memory corruption, not a KVM guest-to-host escape, IOMMU boundary bypass, or other cross-scope boundary violation.
- C:HConfidentiality impact, high
- Unbounded sprintf() writes past the fixed PAGE_SIZE buffer allocated by sysfs_kf_seq_show(), corrupting adjacent kmalloc heap memory. Per kernel guidance, this class of memory-corruption OOB write can be leveraged for arbitrary kernel memory disclosure.
- I:HIntegrity impact, high
- The vulnerable loop advances buf and repeatedly sprintf()s without bounds, producing a kernel heap out-of-bounds write that can corrupt adjacent objects and enable control-flow hijacking or arbitrary kernel writes per OOB-write scoring guidance.
- A:HAvailability impact, high
- Writing past the PAGE_SIZE sysfs show buffer corrupts adjacent kernel heap objects and can cause immediate kernel oops/panic during the read path or when corrupted adjacent allocations are later used, satisfying High availability impact.