CVE-2026-72066

A flaw was found in the Linux kernel, specifically within the CPU hotplug feature. This vulnerability occurs because the states_show() function, which displays CPU hotplug state information, does not correctly limit the size of its output. An attacker could exploit this by providing a large number of registered states, causing the function to write beyond its allocated memory buffer. This uncontrolled write could lead to a system crash (denial of service) or potentially allow for unauthorized access and control (privilege escalation).

This vulnerability is rated as Moderate because exploitation is restricted to local users and requires an unusually large quantity of CPU hotplug states to be dynamically registered before the memory page boundary can be exceeded. Under default Red Hat Enterprise Linux configurations, standard systems maintain a limited set of active hotplug callbacks, preventing the sysfs output from exceeding a single page during normal operation. Consequently, successful exploitation typically requires specialized kernel configurations or privileged module activity to trigger the out-of-bounds write, significantly limiting the overall risk under typical production deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.