CVE-2026-72066 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
cpu: hotplug: Bound hotplug states sysfs output
states_show() adds CPU hotplug state names into a single sysfs buffer using sprintf(). With enough registered states, this can write past the end of the PAGE_SIZE buffer.
Use sysfs_emit_at() so output is bounded.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists in the linux kernel's cpu hotplug subsystem where the states_show() function fails to properly bound its sysfs output operations. The flaw occurs when the kernel attempts to display cpu hotplug state names through sysfs interface using sprintf() which does not enforce buffer size limitations. When a system has numerous registered cpu hotplug states, the cumulative output can exceed the allocated PAGE_SIZE buffer boundaries, leading to potential memory corruption and system instability.
The technical implementation issue stems from the use of unbounded string formatting operations within the kernel's sysfs subsystem. Specifically the states_show() function directly employs sprintf() to populate a sysfs buffer without checking whether the resulting output would exceed the buffer limits. This primitive approach creates a classic buffer overflow condition where the kernel writes beyond allocated memory boundaries, potentially corrupting adjacent memory regions or triggering undefined behavior in the kernel's memory management subsystem.
The operational impact of this vulnerability is significant for systems running linux kernels that expose cpu hotplug states through sysfs interfaces. An attacker could potentially exploit this flaw to cause system crashes, memory corruption, or in extreme cases achieve privilege escalation by carefully crafting the number and content of registered cpu hotplug states. The vulnerability affects any system where cpu hotplug functionality is enabled and where userspace applications query the cpu hotplug state information through sysfs interfaces.
The fix implemented addresses this issue by replacing the unsafe sprintf() usage with sysfs_emit_at() which provides proper bounds checking for sysfs output operations. This change aligns with kernel security best practices and follows the principle of least privilege in memory management. The solution leverages kernel-provided safe string emission functions that automatically handle buffer boundary checks, preventing the overflows that could lead to system instability or security compromise. This remediation approach is consistent with common exploit mitigation techniques recommended in various cybersecurity frameworks including those addressing cwe-121 and cwe-787 memory corruption vulnerabilities.
The vulnerability demonstrates the importance of proper bounds checking in kernel space operations, particularly when dealing with user-facing interfaces like sysfs that can be manipulated by unprivileged users. It highlights how seemingly simple string operations can lead to critical security issues when proper memory management practices are not followed. The fix ensures that kernel subsystems maintain memory safety even under extreme conditions where large amounts of data might need to be exposed through sysfs interfaces, thereby protecting system integrity and preventing potential exploitation scenarios that could affect the broader computing environment.