CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output
In the Linux kernel, the following vulnerability has been resolved:
cpu: hotplug: Bound hotplug states sysfs output
statesshow() adds CPU hotplug state names into a single sysfs buffer using sprintf(). With enough registered states, this can write past the end of the PAGESIZE buffer.
Use sysfsemitat() so output is bounded.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72066?
The severity of CVE-2026-72066 is rated as 15, indicating a critical risk level.
How do I fix CVE-2026-72066?
To fix CVE-2026-72066, ensure you update the Linux kernel to the latest patched version provided by your distribution.
What impact does CVE-2026-72066 have on my system?
CVE-2026-72066 can lead to buffer overflow vulnerabilities in the CPU hotplug functionality, potentially allowing for system instability or unauthorized access.
Is CVE-2026-72066 exploitable remotely?
CVE-2026-72066 is mainly a local vulnerability, but if exploited, it could be used to gain elevated privileges on the system.
Which Linux kernel versions are affected by CVE-2026-72066?
CVE-2026-72066 affects multiple versions of the Linux kernel prior to the security patch, so check your kernel version against the security advisories.