CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
In the Linux kernel, the following vulnerability has been resolved:
cgroup/cpuset: rebind mm mempolicy to effectivemems, not memsallowed
Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOLFRELATIVENODES rebinds in response to a CPU hotplug event.
Reproduction steps: 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems) 2) Move the task into the child cpuset 3) Create a VMA mempolicy for that task with MPOLFRELATIVENODES 4) unplug and hotplug a cpu echo 0 > /sys/devices/system/cpu/cpu1/online echo 1 > /sys/devices/system/cpu/cpu1/online 5) mempolicy rebind does a div/0 in mpolrelativenodemask on the call to nodesfold()
The cpuset code passes (cs->memsallowed) which is not guaranteed to have nodes to the rebind routine. Use cs->effectivemems instead, which is guaranteed to have a non-empty nodemask once we reach that code path.
[ david: add a comment, slightly rephrase description ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed - Compensating control
Avoid CPU hotplug events (e.g., do not execute echo 0 > /sys/devices/system/cpu/cpu1/online followed by echo 1 > /sys/devices/system/cpu/cpu1/online) on systems where cpuset child cgroups are created with cpuset.mems never set while tasks use VMA mempolicies with MPOL_F_RELATIVE_NODES.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72010?
CVE-2026-72010 has a risk rating of 30, indicating a significant severity level.
How do I fix CVE-2026-72010?
To mitigate CVE-2026-72010, ensure that cpuset.mems is properly set when creating child cgroups.
What systems are affected by CVE-2026-72010?
CVE-2026-72010 affects the Linux kernel and can impact any system utilizing this version.
What happens if CVE-2026-72010 is exploited?
Exploitation of CVE-2026-72010 could lead to a division by zero error, potentially causing system instability.
Is there a patch available for CVE-2026-72010?
Yes, a patch for CVE-2026-72010 has been released as part of the Linux kernel updates.