Executive brief
The Linux kernel's CPU hotplug subsystem exposes a sysfs interface that lists registered CPU hotplug states. A buffer overflow vulnerability in the sysfs output handler can allow local attackers to write past the end of a kernel memory buffer when enough hotplug states are registered, potentially enabling kernel code execution or system crash.
Technical details
The vulnerability exists in the states_show() function (also referenced as show_cpuhp_states() in some kernel versions) in kernel/cpu.c, which uses sprintf() to write CPU hotplug state names into a fixed PAGE_SIZE sysfs buffer without bounds checking. An attacker with the ability to register a large number of CPU hotplug states can trigger the buffer to overflow past the PAGE_SIZE limit. The fix replaces sprintf() with sysfs_emit_at(), which enforces bounds checking on the output buffer. This is a local vulnerability requiring local system access to trigger, but can result in kernel memory corruption and arbitrary code execution.
Affected products
- Linux Linux kernel multiple versions; patched in commits 2408be459c70ef4250da1a9e50f5478e6b250d61 and 27481cf4365a6ff5c9be3590143e7ed434000266
Timeline
- 2026-08-15: disclosed: CVE-2026-72066 published
- 2026-06-19: other: Patch authored by Bradley Morgan
- 2026-07-24: other: Patch merged into linux-stable
- 2026-08-19: other: Patch backported to additional stable branches