CVE-2026-72066 - Vulnerability Details

- cpu: hotplug: Bound hotplug states sysfs output

Description

In the Linux kernel, the following vulnerability has been resolved:

cpu: hotplug: Bound hotplug states sysfs output

states_show() adds CPU hotplug state names into a single sysfs buffer
using sprintf(). With enough registered states, this can write past the
end of the PAGE_SIZE buffer.

Use sysfs_emit_at() so output is bounded.

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`98f8cdce1db580b99fce823a48eea2cb2bdb261e`	affected	< 2408be459c70ef4250da1a9e50f5478e6b250d61
`98f8cdce1db580b99fce823a48eea2cb2bdb261e`	affected	< de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635
`98f8cdce1db580b99fce823a48eea2cb2bdb261e`	affected	< 998f66e9ce320f3433f60b948e3698b744754a46
`98f8cdce1db580b99fce823a48eea2cb2bdb261e`	affected	< 61a73a123ac7a7fbc57382531f8cb7092d569aba
`98f8cdce1db580b99fce823a48eea2cb2bdb261e`	affected	< 6cb15b81ff545840048fb0e1a6e827d560dbf367
`98f8cdce1db580b99fce823a48eea2cb2bdb261e`	affected	< 631d53102da9f469c96b882b770336bec095b833
`98f8cdce1db580b99fce823a48eea2cb2bdb261e`	affected	< 86f436567f2516a0083b210bedc933544826a2c3

Linux

affected

Version	Status	Constraints
`4.6`	affected	—
`0`	unaffected	< 4.6
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[98f8cdce1db580b99fce823a48eea2cb2bdb261e,2408be459c70ef4250da1a9e50f5478e6b250d61)`	affected	code_commit	—
`[98f8cdce1db580b99fce823a48eea2cb2bdb261e,61a73a123ac7a7fbc57382531f8cb7092d569aba)`	affected	code_commit	—
`[98f8cdce1db580b99fce823a48eea2cb2bdb261e,631d53102da9f469c96b882b770336bec095b833)`	affected	code_commit	—
`[98f8cdce1db580b99fce823a48eea2cb2bdb261e,6cb15b81ff545840048fb0e1a6e827d560dbf367)`	affected	code_commit	—
`[98f8cdce1db580b99fce823a48eea2cb2bdb261e,86f436567f2516a0083b210bedc933544826a2c3)`	affected	code_commit	—
`[98f8cdce1db580b99fce823a48eea2cb2bdb261e,998f66e9ce320f3433f60b948e3698b744754a46)`	affected	code_commit	—
`[98f8cdce1db580b99fce823a48eea2cb2bdb261e,de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.6`	affected	generic	—
`[0,4.6)`	unaffected	generic	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2408be459c70ef4250da1a9e50f5478e6b250d61
https://git.kernel.org/stable/c/61a73a123ac7a7fbc57382531f8cb7092d569aba
https://git.kernel.org/stable/c/631d53102da9f469c96b882b770336bec095b833
https://git.kernel.org/stable/c/6cb15b81ff545840048fb0e1a6e827d560dbf367
https://git.kernel.org/stable/c/86f436567f2516a0083b210bedc933544826a2c3
https://git.kernel.org/stable/c/998f66e9ce320f3433f60b948e3698b744754a46
https://git.kernel.org/stable/c/de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635

History

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output states_show() adds CPU hotplug state names into a single sysfs buffer using sprintf(). With enough registered states, this can write past the end of the PAGE_SIZE buffer. Use sysfs_emit_at() so output is bounded.
Title		cpu: hotplug: Bound hotplug states sysfs output
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2408be459c70ef4250da1a9e50f5478e6b250d61 https://git.kernel.org/stable/c/61a73a123ac7a7fbc57382531f8cb7092d569aba https://git.kernel.org/stable/c/631d53102da9f469c96b882b770336bec095b833 https://git.kernel.org/stable/c/6cb15b81ff545840048fb0e1a6e827d560dbf367 https://git.kernel.org/stable/c/86f436567f2516a0083b210bedc933544826a2c3 https://git.kernel.org/stable/c/998f66e9ce320f3433f60b948e3698b744754a46 https://git.kernel.org/stable/c/de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:19.527Z

Updated: 2026-08-15T05:52:19.527Z

Reserved: 2026-08-09T03:40:39.903Z

Link: CVE-2026-72066

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:16.203

Modified: 2026-08-15T06:21:16.203

Link: CVE-2026-72066

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T10:45:06Z

Weaknesses

No weakness.

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object