CVE-2026-72066cpu: hotplug: Bound hotplug states sysfs output
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output states_show() adds CPU hotplug state names into a single sysfs buffer using sprintf(). With enough registered states, this can write past the end of the PAGE_SIZE buffer. Use sysfs_emit_at() so output is bounded.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 98f8cdce1db580b99fce823a48eea2cb2bdb261e before 27481cf4365a6ff5c9be3590143e7ed434000266; from 98f8cdce1db580b99fce823a48eea2cb2bdb261e before 2408be459c70ef4250da1a9e50f5478e6b250d61; from 98f8cdce1db580b99fce823a48eea2cb2bdb261e before de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635; from 98f8cdce1db580b99fce823a48eea2cb2bdb261e before 998f66e9ce320f3433f60b948e3698b744754a46; 98f8cdce1db580b99fce823a48eea2cb2bdb261e builds before 61a73a123ac7a7fbc57382531f8cb7092d569aba; 98f8cdce1db580b99fce823a48eea2cb2bdb261e builds before 6cb15b81ff545840048fb0e1a6e827d560dbf367; from 98f8cdce1db580b99fce823a48eea2cb2bdb261e before 631d53102da9f469c96b882b770336bec095b833; 98f8cdce1db580b99fce823a48eea2cb2bdb261e builds before 86f436567f2516a0083b210bedc933544826a2c3 | CNA record |
References
- https://git.kernel.org/stable/c/27481cf4365a6ff5c9be3590143e7ed434000266
- https://git.kernel.org/stable/c/2408be459c70ef4250da1a9e50f5478e6b250d61
- https://git.kernel.org/stable/c/de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635
- https://git.kernel.org/stable/c/998f66e9ce320f3433f60b948e3698b744754a46
- https://git.kernel.org/stable/c/61a73a123ac7a7fbc57382531f8cb7092d569aba
- https://git.kernel.org/stable/c/6cb15b81ff545840048fb0e1a6e827d560dbf367
- https://git.kernel.org/stable/c/631d53102da9f469c96b882b770336bec095b833
- https://git.kernel.org/stable/c/86f436567f2516a0083b210bedc933544826a2c3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.