CVE-2026-72169 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES
When using scratch_scale, the scratch sizes are rounded up to CMA_MIN_ALIGNMENT_BYTES since they will be released as MIGRATE_CMA. This is not done when using fixed scratch sizes via command line. This can result in user specifying a size which is not aligned, and thus kernel releasing a pageblock that is only partially scratch.
Do the rounding up for both cases in scratch_size_update().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides within the Linux kernel's memory management subsystem, specifically affecting the CMA (Contiguous Memory Allocator) implementation. The issue manifests when handling scratch buffer allocation for memory management operations, where inconsistent alignment handling between different allocation pathways creates potential memory corruption risks. The vulnerability stems from a design inconsistency in how scratch buffer sizes are processed when specified through command line parameters versus those determined via dynamic scaling mechanisms.
The technical flaw occurs in the scratch_size_update() function which fails to consistently apply CMA_MIN_ALIGNMENT_BYTES rounding to all scratch size calculations. When using scratch_scale parameter, the system properly rounds up scratch sizes to meet CMA_MIN_ALIGNMENT_BYTES requirements before releasing memory as MIGRATE_CMA type. However, when scratch sizes are specified directly via command line arguments, this alignment enforcement is omitted, allowing potentially misaligned buffer sizes to be processed. This inconsistency creates a scenario where kernel memory management operations might attempt to release page blocks that contain only partially usable scratch space, leading to potential memory fragmentation and operational instability.
The operational impact of this vulnerability extends beyond simple memory management inefficiencies to potentially compromise system stability and security. When scratch buffers are not properly aligned to CMA_MIN_ALIGNMENT_BYTES boundaries, the kernel's memory allocator may encounter issues during page block release operations, particularly when dealing with MIGRATE_CMA type allocations. This misalignment can result in memory fragmentation patterns that degrade system performance over time, while also creating potential attack surfaces where malicious actors might exploit inconsistent memory handling behaviors to disrupt normal system operations or potentially escalate privileges through memory corruption scenarios.
The vulnerability demonstrates a clear deviation from established memory management best practices and aligns with CWE-128 violations related to improper boundary checking in memory allocation. From an ATT&CK framework perspective, this issue could potentially enable privilege escalation techniques through memory corruption exploitation, particularly when combined with other kernel vulnerabilities. The inconsistent alignment handling represents a failure in defensive programming principles that should ensure uniform processing of similar data types regardless of input method. Mitigation strategies should focus on enforcing consistent alignment behavior across all code paths within the scratch size update mechanism, ensuring that both dynamically scaled and statically specified buffer sizes undergo identical alignment processing before memory allocation operations are completed.
This vulnerability highlights the importance of maintaining consistent security boundaries in kernel memory management systems, where seemingly minor implementation inconsistencies can create significant operational risks. The fix requires modifying the scratch_size_update() function to uniformly apply CMA_MIN_ALIGNMENT_BYTES rounding regardless of how scratch sizes are initially specified, thereby ensuring that all memory release operations occur on properly aligned page boundaries and preventing partial page block releases that could compromise system integrity.