CVE-2026-72067cpu: hotplug: Preserve per instance callback errors
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhp_invoke_callback() unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the original error and make the failed transition look successful. Keep the rollback result separate from the original error.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 724a86881d03ee5794148e65142e24ed3621be66 before fe9c8d641f6991614d1229a3ffd3e33b879bba9c; from 724a86881d03ee5794148e65142e24ed3621be66 before ef39758637cc5b603fb05b625c45a98aa306e338; from 724a86881d03ee5794148e65142e24ed3621be66 before 95232281512b15338549171ed9a2acf21f946ffb; 724a86881d03ee5794148e65142e24ed3621be66 builds before 7a68257b90d8a9b6d605abc99469ded45ecba63b; 724a86881d03ee5794148e65142e24ed3621be66 builds before 77d4fa8a3ea1c3e8b996ac35e59aee9e77389905; from 724a86881d03ee5794148e65142e24ed3621be66 before f77117530fc3f5932ffb107182a6dd34006be9b6; 724a86881d03ee5794148e65142e24ed3621be66 builds before 9f7dc355f62c011e4afe8286cf71130d4bfb9d80; 724a86881d03ee5794148e65142e24ed3621be66 builds before 673db10729fb121ea1b16fe57791a0cb9eac1eb5 | CNA record |
References
- https://git.kernel.org/stable/c/fe9c8d641f6991614d1229a3ffd3e33b879bba9c
- https://git.kernel.org/stable/c/ef39758637cc5b603fb05b625c45a98aa306e338
- https://git.kernel.org/stable/c/95232281512b15338549171ed9a2acf21f946ffb
- https://git.kernel.org/stable/c/7a68257b90d8a9b6d605abc99469ded45ecba63b
- https://git.kernel.org/stable/c/77d4fa8a3ea1c3e8b996ac35e59aee9e77389905
- https://git.kernel.org/stable/c/f77117530fc3f5932ffb107182a6dd34006be9b6
- https://git.kernel.org/stable/c/9f7dc355f62c011e4afe8286cf71130d4bfb9d80
- https://git.kernel.org/stable/c/673db10729fb121ea1b16fe57791a0cb9eac1eb5
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.