CVE-2026-72016: cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
In the Linux kernel, the following vulnerability has been resolved:
cpu/hotplug: Fix NULL kobject warning in cpuhpsmtenable()
On arm64, when booting with maxcpus greater than the number of present CPUs (e.g., QEMU -smp cpus=4,maxcpus=8), some CPUs are marked as 'present' but have not yet been registered via registercpu(). Consequently, the per-cpu device objects for these CPUs are not yet initialized.
In cpuhpsmtenable(), the code iterates over all present CPUs. Calling cpuup() for these unregistered CPUs eventually leads to sysfscreategroup() being called with a NULL kobject (or a kobject without a directory), triggering the following warning in fs/sysfs/group.c:
WARNING: fs/sysfs/group.c:137 at internalcreategroup+0x41c/0x4bc, CPU#2: sh/181 [...] Call trace: internalcreategroup+0x41c/0x4bc (P) sysfscreategroup+0x18/0x24 topologyadddev+0x1c/0x28 cpuhpinvokecallback+0x104/0x20c cpuhpinvokecallbackrange+0x94/0x11c cpuup+0x200/0x37c
When booting with ACPI, arm64 smppreparecpus() currently sets all enumerated CPUs as "present" regardless of their status in the MADT. This causes issues with SMT hotplug control. For instance, with QEMU's "-smp 4,maxcpus=8" configuration, the MADT GICC entries are populated as follows:
1. The first four CPUs: Enabled set but Online Capable not set.
2. The remaining four CPUs: Online Capable set but Enabled not set to support potential hot-plugging.
Fix this by:
1. When booting with ACPI, checking the ACPIMADTENABLED flag in the GICC entry before calling setcpupresent() during SMP initialization.
2. Properly managing the present mask in acpimapcpu() and acpiunmapcpu() to support actual CPU hotplug events, This aligns with other architectures like x86 and LoongArch.
3. Update the arm64 CPU hotplug documentation to no longer state that all online-capable vCPUs are marked as present by the kernel at boot time.
This ensures that only physically available or explicitly enabled CPUs are in the present mask, keeping the SMT control logic consistent with the actual hardware state.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72016?
CVE-2026-72016 has a risk severity rating of 11.
How do I fix CVE-2026-72016?
To fix CVE-2026-72016, you should upgrade to the latest version of the Linux kernel that addresses this vulnerability.
What impact does CVE-2026-72016 have on system security?
CVE-2026-72016 could potentially lead to system instability or crashes due to CPU hotplugging issues.
In which systems is CVE-2026-72016 applicable?
CVE-2026-72016 is applicable in systems running the affected versions of the Linux kernel, particularly on arm64 architecture.
What should I monitor for regarding CVE-2026-72016?
You should monitor your Linux kernel versions and ensure they are patched against CVE-2026-72016 to avoid any potential issues.