Executive brief
The Linux kernel's CPU hotplug mechanism contains a flaw in how it handles errors during callback execution. When a callback fails during CPU state transitions, the system's error recovery logic could incorrectly mask the original failure, causing the kernel to report success when a critical operation actually failed. This could lead to system instability or undefined behavior in multi-CPU systems during hotplug events.
Technical details
The vulnerability exists in the cpuhp_invoke_callback() function in kernel/cpu.c, which manages CPU hotplug state transitions. When a callback fails for one CPU instance, the function attempts to rollback by invoking earlier callbacks for the same hotplug state. However, the rollback path reuses the same return value variable (ret) for both the original error and the rollback result. If the rollback succeeds (returns 0), it overwrites the original error code, causing the function to return success despite the initial failure. An attacker with local access triggering CPU hotplug operations could exploit this to cause unexpected system behavior. The fix separates the rollback result into a distinct variable (rollback_ret) to preserve the original error code, ensuring proper error reporting.
Affected products
- Linux Linux kernel All versions prior to patch 673db10729fb121ea1b16fe57791a0cb9eac1eb5
Timeline
- 2026-08-15: disclosed
- 2026-06-21: patched