CVE-2026-72066 (GCVE-0-2026-72066)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-19 16:35
VLAI
Title
cpu: hotplug: Bound hotplug states sysfs output
Summary
In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output states_show() adds CPU hotplug state names into a single sysfs buffer using sprintf(). With enough registered states, this can write past the end of the PAGE_SIZE buffer. Use sysfs_emit_at() so output is bounded.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 98f8cdce1db580b99fce823a48eea2cb2bdb261e , < 27481cf4365a6ff5c9be3590143e7ed434000266 (git)
Affected: 98f8cdce1db580b99fce823a48eea2cb2bdb261e , < 2408be459c70ef4250da1a9e50f5478e6b250d61 (git)
Affected: 98f8cdce1db580b99fce823a48eea2cb2bdb261e , < de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635 (git)
Affected: 98f8cdce1db580b99fce823a48eea2cb2bdb261e , < 998f66e9ce320f3433f60b948e3698b744754a46 (git)
Affected: 98f8cdce1db580b99fce823a48eea2cb2bdb261e , < 61a73a123ac7a7fbc57382531f8cb7092d569aba (git)
Affected: 98f8cdce1db580b99fce823a48eea2cb2bdb261e , < 6cb15b81ff545840048fb0e1a6e827d560dbf367 (git)
Affected: 98f8cdce1db580b99fce823a48eea2cb2bdb261e , < 631d53102da9f469c96b882b770336bec095b833 (git)
Affected: 98f8cdce1db580b99fce823a48eea2cb2bdb261e , < 86f436567f2516a0083b210bedc933544826a2c3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/cpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "27481cf4365a6ff5c9be3590143e7ed434000266",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "2408be459c70ef4250da1a9e50f5478e6b250d61",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "998f66e9ce320f3433f60b948e3698b744754a46",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "61a73a123ac7a7fbc57382531f8cb7092d569aba",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "6cb15b81ff545840048fb0e1a6e827d560dbf367",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "631d53102da9f469c96b882b770336bec095b833",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "86f436567f2516a0083b210bedc933544826a2c3",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/cpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpu: hotplug: Bound hotplug states sysfs output\n\nstates_show() adds CPU hotplug state names into a single sysfs buffer\nusing sprintf(). With enough registered states, this can write past the\nend of the PAGE_SIZE buffer.\n\nUse sysfs_emit_at() so output is bounded."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in states_show() on the read path for /sys/devices/system/cpu/hotplug/states, reached only via a local sysfs/VFS read() syscall. No network packet handler, adjacent protocol, or physical attach path invokes this CPU hotplug sysfs callback.\nAC:L - Once enough CPU hotplug states are registered (plausible on cloud servers, KVM hosts, Android, and heavily configured distros with hundreds of cpuhp_setup_state() users), a single read deterministically executes unbounded sprintf() past the PAGE_SIZE buffer with no race or attacker-uncontrollable timing.\nPR:L - states is DEVICE_ATTR_RO (mode 0444), so any unprivileged local user can open and read /sys/devices/system/cpu/hotplug/states. states_show() performs no capability, namespace, or credential check before formatting output into the sysfs buffer.\nUI:N - Exploitation requires only the attacker reading the sysfs attribute; no victim mount, driver bind, module load, or other interactive action is needed beyond the attacker\u0027s own read once sufficient hotplug states exist at boot.\nS:U - The out-of-bounds write corrupts kernel heap memory within the same OS/kernel security authority. This is standard kernel memory corruption, not a KVM guest-to-host escape, IOMMU boundary bypass, or other cross-scope boundary violation.\nC:H - Unbounded sprintf() writes past the fixed PAGE_SIZE buffer allocated by sysfs_kf_seq_show(), corrupting adjacent kmalloc heap memory. Per kernel guidance, this class of memory-corruption OOB write can be leveraged for arbitrary kernel memory disclosure.\nI:H - The vulnerable loop advances buf and repeatedly sprintf()s without bounds, producing a kernel heap out-of-bounds write that can corrupt adjacent objects and enable control-flow hijacking or arbitrary kernel writes per OOB-write scoring guidance.\nA:H - Writing past the PAGE_SIZE sysfs show buffer corrupts adjacent kernel heap objects and can cause immediate kernel oops/panic during the read path or when corrupted adjacent allocations are later used, satisfying High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:55.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/27481cf4365a6ff5c9be3590143e7ed434000266"
        },
        {
          "url": "https://git.kernel.org/stable/c/2408be459c70ef4250da1a9e50f5478e6b250d61"
        },
        {
          "url": "https://git.kernel.org/stable/c/de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635"
        },
        {
          "url": "https://git.kernel.org/stable/c/998f66e9ce320f3433f60b948e3698b744754a46"
        },
        {
          "url": "https://git.kernel.org/stable/c/61a73a123ac7a7fbc57382531f8cb7092d569aba"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cb15b81ff545840048fb0e1a6e827d560dbf367"
        },
        {
          "url": "https://git.kernel.org/stable/c/631d53102da9f469c96b882b770336bec095b833"
        },
        {
          "url": "https://git.kernel.org/stable/c/86f436567f2516a0083b210bedc933544826a2c3"
        }
      ],
      "title": "cpu: hotplug: Bound hotplug states sysfs output",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72066",
    "datePublished": "2026-08-15T05:52:19.527Z",
    "dateReserved": "2026-08-09T03:40:39.903Z",
    "dateUpdated": "2026-08-19T16:35:55.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72066",
      "date": "2026-09-22",
      "epss": "0.00176",
      "percentile": "0.07397"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/cpu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "27481cf4365a6ff5c9be3590143e7ed434000266",
                    "status": "affected",
                    "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2408be459c70ef4250da1a9e50f5478e6b250d61",
                    "status": "affected",
                    "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635",
                    "status": "affected",
                    "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "998f66e9ce320f3433f60b948e3698b744754a46",
                    "status": "affected",
                    "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "61a73a123ac7a7fbc57382531f8cb7092d569aba",
                    "status": "affected",
                    "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6cb15b81ff545840048fb0e1a6e827d560dbf367",
                    "status": "affected",
                    "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "631d53102da9f469c96b882b770336bec095b833",
                    "status": "affected",
                    "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "86f436567f2516a0083b210bedc933544826a2c3",
                    "status": "affected",
                    "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/cpu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.6"
                  },
                  {
                    "lessThan": "4.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpu: hotplug: Bound hotplug states sysfs output\n\nstates_show() adds CPU hotplug state names into a single sysfs buffer\nusing sprintf(). With enough registered states, this can write past the\nend of the PAGE_SIZE buffer.\n\nUse sysfs_emit_at() so output is bounded."
          }
        ],
        "id": "CVE-2026-72066",
        "lastModified": "2026-08-19T17:20:57.343",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:16.203",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2408be459c70ef4250da1a9e50f5478e6b250d61"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/27481cf4365a6ff5c9be3590143e7ed434000266"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/61a73a123ac7a7fbc57382531f8cb7092d569aba"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/631d53102da9f469c96b882b770336bec095b833"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6cb15b81ff545840048fb0e1a6e827d560dbf367"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/86f436567f2516a0083b210bedc933544826a2c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/998f66e9ce320f3433f60b948e3698b744754a46"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T19:48:49+00:00",
      "cve": "CVE-2026-72066",
      "id": "CVE-2026-72066",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cpu: hotplug: Bound hotplug states sysfs output",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72066.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:30:26Z",
      "cve": "CVE-2026-72066",
      "id": "CVE-2026-72066",
      "initial_release_date": "2026-08-28T01:01:37Z",
      "product_status:known_affected": "315",
      "product_status:known_not_affected": "47",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72066",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72066.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.