Look up another CVE · open CVE-2026-72067 in the interactive tracker
CVE-2026-72067
cpu: hotplug: Preserve per instance callback errors
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem kernel. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72067 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
cpuhp_invoke_callback() unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the original error and make the failed transition look successful. Keep the rollback result separate from the original error.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/cpu.c
- What this is
- CPU HOTPLUGMAINTAINERS section matched on kernel/cpu.c · linux-kernel@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- kernel
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.14 | 5.10.261 | fe9c8d641f69 |
| 4.14 | 5.15.212 | ef39758637cc |
| 4.14 | 6.1.178 | 95232281512b |
| 4.14 | 6.6.145 | 7a68257b90d8 |
| 4.14 | 6.12.97 | 77d4fa8a3ea1 |
| 4.14 | 6.18.40 | f77117530fc3 |
| 4.14 | 7.1.5 | 9f7dc355f62c |
| 4.14 | 7.2 | 673db10729fb |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is in cpuhp_invoke_callback() during CPU hotplug state transitions, reached only via local kernel paths such as sysfs /sys/devices/system/cpu/cpuN/online, device_online/offline, and cpu_up()/cpu_down() from privileged local callers.
- AC:LAttack complexity, low
- An attacker can reliably trigger the bug by inducing multi-instance callback failure (e.g., -ENOMEM via memory pressure) during CPU online/offline on cloud autoscaled nodes or servers running RAID/padata where rollback callbacks succeed and overwrite the original error.
- PR:LPrivileges required, low
- CPU hotplug is normally admin-initiated, but an unprivileged local user can force multi-instance callback failures through memory exhaustion during system/hypervisor CPU hotplug without needing CAP_SYS_ADMIN or user-namespace admin capabilities.
- UI:NUser interaction, none
- Exploitation requires no victim interaction beyond normal system operation; it is triggered during kernel CPU hotplug transitions without the user opening files, mounting filesystems, or performing other deliberate actions.
- S:UScope, unchanged
- The vulnerability corrupts kernel CPU hotplug state-machine consistency and affects kernel subsystems on the same host; it does not cross a VM, container, or IOMMU security boundary to impact a separate authority.
- C:HConfidentiality impact, high
- Silently completing hotplug after a failed multi-instance rollback leaves subsystems like padata and RAID5 in a state inconsistent with the hotplug machine, which can desynchronize RCU-protected structures and enable kernel memory disclosure primitives.
- I:HIntegrity impact, high
- When rollback overwrites the original error with success, cpuhp_up_callbacks()/cpuhp_down_callbacks() proceed and mark the CPU transition complete while multi-instance subsystem callbacks were only partially applied, corrupting kernel integrity and enabling further memory corruption.
- A:HAvailability impact, high
- Proceeding past a failed multi-instance hotplug step while subsystems such as padata, RAID5, or virtio-net instances are left in an inconsistent partially-rolled-back state can cause kernel oops, panic, or hang on production cloud and server systems.