CVE-2026-93172: mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
In the Linux kernel, the following vulnerability has been resolved:
mm/mminit: handle allocpercpu failure in freeareainitcorehotplug
We miss a failed allocation check for pgdat->percpunodestats, which results in a NULL deref when we offset into the per-cpu area.
Propagate -ENOMEM up the stack and leave percpunodestats pointing at bootnodestats so a later online can retry the allocation.
hotaddinitpgdat() returns NULL on failure, which tryonlinenode() already maps to -ENOMEM.
On failure nothing needs to be unwound: - the node is never marked online - percpunodestats is left pointing at bootnodestats - addmemoryresource() cleans up pending memblock resources - later online attempts retry the percpunodestats allocation
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
It can be triggered while bringing a memory node online, when free_area_init_core_hotplug() attempts to allocate pgdat->per_cpu_nodestats and that allocation fails.
What is the impact of a failed allocation?
Without the fix, the failed allocation can lead to a NULL-pointer dereference when the kernel offsets into the per-CPU area. The fix propagates -ENOMEM instead of continuing.
What happens after the fix if a node-online attempt fails?
The node is not marked online, per_cpu_nodestats remains pointed at boot_nodestats, and pending memblock resources are cleaned up. A later attempt to online the node retries the allocation.