CVE-2026-72067 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
cpu: hotplug: Preserve per instance callback errors
cpuhp_invoke_callback() unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the original error and make the failed transition look successful.
Keep the rollback result separate from the original error.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the linux kernel's cpu hotplug subsystem where the cpuhp_invoke_callback() function fails to properly handle error states during callback execution. The issue occurs when multiple callbacks are invoked for the same hotplug state and one of them fails, triggering an automatic rollback mechanism. The current implementation incorrectly reuses the return value variable 'ret' for both the original failing callback and the subsequent rollback operations, which can mask the true nature of the failure. This flaw represents a classic case of error handling contamination where successful rollback operations can overwrite or hide the actual error that occurred during the initial callback execution.
The technical flaw stems from improper error state management within the cpu hotplug subsystem's callback invocation logic. When a callback fails in the cpuhp_invoke_callback() function, the system attempts to unwind previously executed callbacks for the same hotplug state through a rollback mechanism. However, the rollback process uses the same return value variable that was originally set by the failing callback, causing successful rollback operations to overwrite the original error code. This creates a false positive scenario where the system reports successful completion of a hotplug operation even though an actual failure occurred during the initial callback processing phase.
The operational impact of this vulnerability is significant for system stability and reliability in linux environments that utilize cpu hotplug functionality. When a cpu hotplug operation fails due to callback errors, the system may incorrectly report success to administrators and monitoring systems, leading to potential false confidence in system health. This can result in delayed detection of actual hardware or software issues, particularly in high availability systems where cpu hotplug operations are frequently performed for load balancing or maintenance purposes. The vulnerability affects both manual and automated cpu hotplug operations, potentially causing cascading failures when the system continues operating with inconsistent cpu states.
This issue aligns with CWE-704 (Incorrect Error Handling) and represents a failure in proper error propagation mechanisms within kernel subsystems. The vulnerability also relates to ATT&CK technique T1562.001 (Impairing Security Tools) as it can mask actual system failures that security monitoring tools rely on to detect anomalies. To address this flaw, the kernel developers must implement separate return value tracking for original callback errors and rollback operations, ensuring that error information from failed callbacks is preserved throughout the entire hotplug operation lifecycle. The fix involves maintaining distinct error states during rollback operations and properly propagating the original failure condition even when subsequent rollback attempts succeed.
The mitigation strategy requires careful attention to the kernel's error handling patterns and proper separation of concerns within the cpu hotplug subsystem. System administrators should ensure they are running patched kernel versions that contain the corrected error handling logic, particularly in environments where cpu hotplug operations are frequent or critical for system operation. Monitoring systems should be configured to detect anomalous cpu hotplug behavior even when success codes are reported, as this vulnerability can create false positives that mask actual system degradation. The fix demonstrates proper defensive programming practices by ensuring that error information is not overwritten during rollback operations and that all failure conditions are properly preserved for system logging and alerting purposes.
This vulnerability highlights the complexity of error handling in kernel space where rollback mechanisms must preserve original error states while attempting to restore system consistency. The issue emphasizes the importance of maintaining clear separation between different phases of operation within critical subsystems, particularly when dealing with hardware management functions that require precise state tracking. The fix represents a fundamental improvement in kernel robustness and reliability, ensuring that system administrators receive accurate feedback about cpu hotplug operations and can respond appropriately to actual failures rather than being misled by false success indicators.