CVE-2026-72067 - Vulnerability Details

- cpu: hotplug: Preserve per instance callback errors

Description

In the Linux kernel, the following vulnerability has been resolved:

cpu: hotplug: Preserve per instance callback errors

cpuhp_invoke_callback() unwinds earlier callbacks for the same
hotplug state when one instance fails. The rollback path currently
reuses ret, so a successful rollback can hide the original error and
make the failed transition look successful.

Keep the rollback result separate from the original error.

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`724a86881d03ee5794148e65142e24ed3621be66`	affected	< fe9c8d641f6991614d1229a3ffd3e33b879bba9c
`724a86881d03ee5794148e65142e24ed3621be66`	affected	< ef39758637cc5b603fb05b625c45a98aa306e338
`724a86881d03ee5794148e65142e24ed3621be66`	affected	< 95232281512b15338549171ed9a2acf21f946ffb
`724a86881d03ee5794148e65142e24ed3621be66`	affected	< 7a68257b90d8a9b6d605abc99469ded45ecba63b
`724a86881d03ee5794148e65142e24ed3621be66`	affected	< 77d4fa8a3ea1c3e8b996ac35e59aee9e77389905
`724a86881d03ee5794148e65142e24ed3621be66`	affected	< f77117530fc3f5932ffb107182a6dd34006be9b6
`724a86881d03ee5794148e65142e24ed3621be66`	affected	< 9f7dc355f62c011e4afe8286cf71130d4bfb9d80
`724a86881d03ee5794148e65142e24ed3621be66`	affected	< 673db10729fb121ea1b16fe57791a0cb9eac1eb5

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[724a86881d03ee5794148e65142e24ed3621be66,fe9c8d641f6991614d1229a3ffd3e33b879bba9c)`	affected	code_commit	—
`[724a86881d03ee5794148e65142e24ed3621be66,ef39758637cc5b603fb05b625c45a98aa306e338)`	affected	code_commit	—
`[724a86881d03ee5794148e65142e24ed3621be66,95232281512b15338549171ed9a2acf21f946ffb)`	affected	code_commit	—
`[724a86881d03ee5794148e65142e24ed3621be66,7a68257b90d8a9b6d605abc99469ded45ecba63b)`	affected	code_commit	—
`[724a86881d03ee5794148e65142e24ed3621be66,77d4fa8a3ea1c3e8b996ac35e59aee9e77389905)`	affected	code_commit	—
`[724a86881d03ee5794148e65142e24ed3621be66,f77117530fc3f5932ffb107182a6dd34006be9b6)`	affected	code_commit	—
`[724a86881d03ee5794148e65142e24ed3621be66,9f7dc355f62c011e4afe8286cf71130d4bfb9d80)`	affected	code_commit	—
`[724a86881d03ee5794148e65142e24ed3621be66,673db10729fb121ea1b16fe57791a0cb9eac1eb5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.14`	affected	semver	—
`[0,4.14)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/673db10729fb121ea1b16fe57791a0cb9eac1eb5
https://git.kernel.org/stable/c/77d4fa8a3ea1c3e8b996ac35e59aee9e77389905
https://git.kernel.org/stable/c/7a68257b90d8a9b6d605abc99469ded45ecba63b
https://git.kernel.org/stable/c/95232281512b15338549171ed9a2acf21f946ffb
https://git.kernel.org/stable/c/9f7dc355f62c011e4afe8286cf71130d4bfb9d80
https://git.kernel.org/stable/c/ef39758637cc5b603fb05b625c45a98aa306e338
https://git.kernel.org/stable/c/f77117530fc3f5932ffb107182a6dd34006be9b6
https://git.kernel.org/stable/c/fe9c8d641f6991614d1229a3ffd3e33b879bba9c

History

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhp_invoke_callback() unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the original error and make the failed transition look successful. Keep the rollback result separate from the original error.
Title		cpu: hotplug: Preserve per instance callback errors
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/673db10729fb121ea1b16fe57791a0cb9eac1eb5 https://git.kernel.org/stable/c/77d4fa8a3ea1c3e8b996ac35e59aee9e77389905 https://git.kernel.org/stable/c/7a68257b90d8a9b6d605abc99469ded45ecba63b https://git.kernel.org/stable/c/95232281512b15338549171ed9a2acf21f946ffb https://git.kernel.org/stable/c/9f7dc355f62c011e4afe8286cf71130d4bfb9d80 https://git.kernel.org/stable/c/ef39758637cc5b603fb05b625c45a98aa306e338 https://git.kernel.org/stable/c/f77117530fc3f5932ffb107182a6dd34006be9b6 https://git.kernel.org/stable/c/fe9c8d641f6991614d1229a3ffd3e33b879bba9c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:20.268Z

Updated: 2026-08-15T05:52:20.268Z

Reserved: 2026-08-09T03:40:39.903Z

Link: CVE-2026-72067

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:16.327

Modified: 2026-08-15T06:21:16.327

Link: CVE-2026-72067

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T11:30:06Z

Weaknesses

No weakness.

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object