CVE-2026-72181 (GCVE-0-2026-72181)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-19 16:36
VLAI
Title
mips: sched: Fix CPUMASK_OFFSTACK memory corruption
Summary
In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASK_OFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer. Consequently, sizeof(new_mask) evaluates to the pointer size, causing copy_from_user() to clobber the mask pointer. Furthermore, the old logic performed copy_from_user() before allocating the mask. Fix this by allocating new_mask first. To handle variable-sized user masks correctly, use cpumask_size() to truncate overly large user masks or pad undersized masks with zeros before copying the data directly into the allocated buffer.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 295cbf6d63165fe4253cf1d9ceadcda47a318b48 , < 2f7730c03a9deea3ba7a1c980070d363b4ea2046 (git)
Affected: 295cbf6d63165fe4253cf1d9ceadcda47a318b48 , < d20ee42f8226607b5693b2bc2f115ca2d270221a (git)
Affected: 295cbf6d63165fe4253cf1d9ceadcda47a318b48 , < 15ba8053fe4162c933855f1676fb321cdb6251c7 (git)
Affected: 295cbf6d63165fe4253cf1d9ceadcda47a318b48 , < 3446ffb5d03c36f9ce88ede7ca5be319a2968d96 (git)
Affected: 295cbf6d63165fe4253cf1d9ceadcda47a318b48 , < 87a56c1e8e36d06ebe8640432f911538ded7827d (git)
Affected: 295cbf6d63165fe4253cf1d9ceadcda47a318b48 , < 1caee6e084a96ada94658f261ced377d85af3f03 (git)
Affected: 295cbf6d63165fe4253cf1d9ceadcda47a318b48 , < a1dd41d00c57efb1fbc6f361c5f48c9d00cca51c (git)
Affected: 295cbf6d63165fe4253cf1d9ceadcda47a318b48 , < 98e37db4a34d3af3fb2f4648295c25b5e40b20e3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.23
Unaffected: 0 , < 2.6.23 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/mips/kernel/mips-mt-fpaff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f7730c03a9deea3ba7a1c980070d363b4ea2046",
              "status": "affected",
              "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
              "versionType": "git"
            },
            {
              "lessThan": "d20ee42f8226607b5693b2bc2f115ca2d270221a",
              "status": "affected",
              "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
              "versionType": "git"
            },
            {
              "lessThan": "15ba8053fe4162c933855f1676fb321cdb6251c7",
              "status": "affected",
              "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
              "versionType": "git"
            },
            {
              "lessThan": "3446ffb5d03c36f9ce88ede7ca5be319a2968d96",
              "status": "affected",
              "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
              "versionType": "git"
            },
            {
              "lessThan": "87a56c1e8e36d06ebe8640432f911538ded7827d",
              "status": "affected",
              "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
              "versionType": "git"
            },
            {
              "lessThan": "1caee6e084a96ada94658f261ced377d85af3f03",
              "status": "affected",
              "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
              "versionType": "git"
            },
            {
              "lessThan": "a1dd41d00c57efb1fbc6f361c5f48c9d00cca51c",
              "status": "affected",
              "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
              "versionType": "git"
            },
            {
              "lessThan": "98e37db4a34d3af3fb2f4648295c25b5e40b20e3",
              "status": "affected",
              "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/mips/kernel/mips-mt-fpaff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.23"
            },
            {
              "lessThan": "2.6.23",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmips: sched: Fix CPUMASK_OFFSTACK memory corruption\n\nThis patch addresses a critical memory management flaw. When\nCONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer.\nConsequently, sizeof(new_mask) evaluates to the pointer size, causing\ncopy_from_user() to clobber the mask pointer. Furthermore, the old\nlogic performed copy_from_user() before allocating the mask.\n\nFix this by allocating new_mask first. To handle variable-sized user\nmasks correctly, use cpumask_size() to truncate overly large user masks\nor pad undersized masks with zeros before copying the data directly into\nthe allocated buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires invoking the sched_setaffinity syscall on a MIPS o32 kernel; the vulnerable mipsmt_sys_sched_setaffinity handler is only wired into the o32 syscall table and is not reachable from remote network protocols.\nAC:L - On affected builds the attacker reliably triggers the flaw with a single sched_setaffinity syscall supplying a user buffer; no races, special victim state, or uncontrollable memory layout are required beyond calling the syscall with attacker-chosen mask bytes.\nPR:L - Any unprivileged local user can call sched_setaffinity; the corrupting copy_from_user runs before check_same_owner/CAP_SYS_NICE, and setting affinity on one\u0027s own process needs no special capabilities beyond normal local execution.\nUI:N - Exploitation requires only a direct sched_setaffinity syscall from the attacker; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - The vulnerability corrupts kernel stack/scheduler state within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - Misplaced copy_from_user clobbers a kernel stack pointer with attacker-controlled bytes, and the never-initialized kmalloc cpumask can be stored in user_cpus_allowed and leaked back to userspace via sched_getaffinity.\nI:H - The bug is a kernel memory corruption from writing attacker-controlled data to the wrong address (the cpumask pointer on the stack) before allocation, which is an out-of-bounds-style write primitive in kernel context.\nA:H - Kernel memory corruption in the sched_setaffinity path can cause oops, panic, or wedged scheduling/affinity state; corrupted stack data and misuse of uninitialized cpumask contents can crash or hang the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:28.810Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f7730c03a9deea3ba7a1c980070d363b4ea2046"
        },
        {
          "url": "https://git.kernel.org/stable/c/d20ee42f8226607b5693b2bc2f115ca2d270221a"
        },
        {
          "url": "https://git.kernel.org/stable/c/15ba8053fe4162c933855f1676fb321cdb6251c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3446ffb5d03c36f9ce88ede7ca5be319a2968d96"
        },
        {
          "url": "https://git.kernel.org/stable/c/87a56c1e8e36d06ebe8640432f911538ded7827d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1caee6e084a96ada94658f261ced377d85af3f03"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1dd41d00c57efb1fbc6f361c5f48c9d00cca51c"
        },
        {
          "url": "https://git.kernel.org/stable/c/98e37db4a34d3af3fb2f4648295c25b5e40b20e3"
        }
      ],
      "title": "mips: sched: Fix CPUMASK_OFFSTACK memory corruption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72181",
    "datePublished": "2026-08-15T05:53:44.453Z",
    "dateReserved": "2026-08-09T03:40:39.910Z",
    "dateUpdated": "2026-08-19T16:36:28.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72181",
      "date": "2026-09-21",
      "epss": "0.00164",
      "percentile": "0.06049"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/mips/kernel/mips-mt-fpaff.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2f7730c03a9deea3ba7a1c980070d363b4ea2046",
                    "status": "affected",
                    "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d20ee42f8226607b5693b2bc2f115ca2d270221a",
                    "status": "affected",
                    "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "15ba8053fe4162c933855f1676fb321cdb6251c7",
                    "status": "affected",
                    "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3446ffb5d03c36f9ce88ede7ca5be319a2968d96",
                    "status": "affected",
                    "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "87a56c1e8e36d06ebe8640432f911538ded7827d",
                    "status": "affected",
                    "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1caee6e084a96ada94658f261ced377d85af3f03",
                    "status": "affected",
                    "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a1dd41d00c57efb1fbc6f361c5f48c9d00cca51c",
                    "status": "affected",
                    "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "98e37db4a34d3af3fb2f4648295c25b5e40b20e3",
                    "status": "affected",
                    "version": "295cbf6d63165fe4253cf1d9ceadcda47a318b48",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/mips/kernel/mips-mt-fpaff.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.23"
                  },
                  {
                    "lessThan": "2.6.23",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmips: sched: Fix CPUMASK_OFFSTACK memory corruption\n\nThis patch addresses a critical memory management flaw. When\nCONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer.\nConsequently, sizeof(new_mask) evaluates to the pointer size, causing\ncopy_from_user() to clobber the mask pointer. Furthermore, the old\nlogic performed copy_from_user() before allocating the mask.\n\nFix this by allocating new_mask first. To handle variable-sized user\nmasks correctly, use cpumask_size() to truncate overly large user masks\nor pad undersized masks with zeros before copying the data directly into\nthe allocated buffer."
          }
        ],
        "id": "CVE-2026-72181",
        "lastModified": "2026-08-19T17:21:00.547",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:36.393",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/15ba8053fe4162c933855f1676fb321cdb6251c7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1caee6e084a96ada94658f261ced377d85af3f03"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2f7730c03a9deea3ba7a1c980070d363b4ea2046"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3446ffb5d03c36f9ce88ede7ca5be319a2968d96"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/87a56c1e8e36d06ebe8640432f911538ded7827d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/98e37db4a34d3af3fb2f4648295c25b5e40b20e3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a1dd41d00c57efb1fbc6f361c5f48c9d00cca51c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d20ee42f8226607b5693b2bc2f115ca2d270221a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T15:20:39+00:00",
      "cve": "CVE-2026-72181",
      "id": "CVE-2026-72181",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mips: sched: Fix CPUMASK_OFFSTACK memory corruption",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72181.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:28:22Z",
      "cve": "CVE-2026-72181",
      "id": "CVE-2026-72181",
      "initial_release_date": "2026-09-01T13:31:20Z",
      "product_status:known_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72181",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72181.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.