CVE-2026-72016

A flaw was found in the Linux kernel's CPU hotplug mechanism on arm64 systems. When a system is booted with more maximum CPUs configured than are physically present, some CPUs are incorrectly marked as present but are not fully registered. This can lead to a kernel warning due to a null kobject dereference during CPU initialization, potentially affecting system stability and hotplug functionality.

This vulnerability is rated as Moderate impact because triggering it requires specific hypervisor configurations and local administrative actions to hotplug CPUs on arm64 systems, limiting the failure domain to system instability or warning messages. The issue arises only when virtual machines are initialized with a maximum CPU threshold exceeding the initially enabled vCPUs under ACPI. Supported Red Hat Enterprise Linux releases are not affected because the vulnerable logic was introduced in later upstream kernels and is not present in Red Hat kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.