CVE-2026-72067

A flaw was found in the Linux kernel's CPU hotplug mechanism. When the cpuhp_invoke_callback() function attempts to unwind previous operations after a failure, it can incorrectly reuse a return value. This issue allows a successful rollback to mask the original error, causing a failed CPU hotplug transition to appear as if it succeeded. This could lead to the system reporting an incorrect state for CPU hotplug operations.

This vulnerability is rated as Low severity because CPU hotplugging operations require administrative privileges, and the defect only results in masking an error during an aborted transition rather than enabling privilege escalation. Unprivileged local users cannot trigger or manipulate CPU state transitions directly. Consequently, this flaw has minimal security impact on standard Red Hat Enterprise Linux systems, primarily affecting internal state reporting during error unwinding.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.