CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
In the Linux kernel, the following vulnerability has been resolved:
mm/mminit: fix uninitialized struct pages for ZONEDEVICE
If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate() reuses the unoptimized boot memmap. However, compoundnrpages() still assumes that vmemmap optimization is in effect and initializes only the reduced number of struct pages. As a result, the remaining tail struct pages are left uninitialized, which can later lead to unexpected behavior or crashes.
Fix this by treating early sections as unoptimized when calculating how many struct pages to initialize.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72172?
CVE-2026-72172 has a risk rating of 34, indicating a medium level of severity.
How do I fix CVE-2026-72172?
To fix CVE-2026-72172, update your Linux kernel to the latest version where the vulnerability has been patched.
What type of vulnerability is CVE-2026-72172?
CVE-2026-72172 is related to memory management in the Linux kernel, specifically addressing uninitialized struct pages for ZONE_DEVICE.
Which systems are affected by CVE-2026-72172?
CVE-2026-72172 affects systems running specific versions of the Linux kernel that utilize DAX memory.
When was CVE-2026-72172 published?
CVE-2026-72172 was published on August 15, 2026.