Executive brief
The Linux kernel's memory hotplug system can crash when dynamic memory is added to a running system if per-CPU memory allocation fails. This causes a null pointer dereference during memory initialization, potentially disrupting service availability on systems that rely on dynamic memory scaling for load balancing or capacity expansion.
Technical details
A missing error check in the free_area_init_core_hotplug() function fails to validate the return value of alloc_percpu() when allocating per-CPU node statistics structures during memory hotplug operations. The vulnerable code attempts to dereference pgdat->per_cpu_nodestats without checking for allocation failure, leading to a NULL pointer dereference. The fix adds proper error handling to return -ENOMEM on allocation failure and propagates the error up the call stack through hotadd_init_pgdat(). The vulnerability is triggered only during active memory hotplug (CONFIG_MEMORY_HOTPLUG enabled) and requires the system to attempt dynamic memory addition under memory pressure conditions that cause alloc_percpu() to fail.
Affected products
- Linux Linux kernel Affected versions have been patched in mainline commit 2ebce860bdd7ae5e13002811bc9bbbf33fcfc221 (2026-07-02) and stable branches; all kernel versions with CONFIG_MEMORY_HOTPLUG enabled that predate this fix
Timeline
- 2026-07-01: other: Fix authored by Gregory Price
- 2026-07-02: patched: Upstream fix merged in mainline
- 2026-09-17: disclosed: CVE-2026-93172 published