CVE-2026-72172 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
If DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap. However, compound_nr_pages() still assumes that vmemmap optimization is in effect and initializes only the reduced number of struct pages. As a result, the remaining tail struct pages are left uninitialized, which can later lead to unexpected behavior or crashes.
Fix this by treating early sections as unoptimized when calculating how many struct pages to initialize.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the linux kernel's memory management subsystem specifically affecting the initialization of struct pages for ZONE_DEVICE regions. The issue manifests when DAX (Direct Access) memory is dynamically added to an unoccupied subsection of an early memory section through hotplug operations. The problem stems from a fundamental mismatch in how the kernel handles memory map initialization between different phases of system boot and runtime operation. During the early boot phase, memory sections are initialized with boot-time memory maps that may not have undergone vmemmap optimization, yet the code path for handling hotplugged memory fails to account for this distinction properly.
The technical flaw occurs in the section_activate() function which reuses unoptimized boot memmap structures when processing newly added DAX memory regions. However, the compound_nr_pages() function continues to operate under the assumption that vmemmap optimization has been applied throughout the system, leading to an incorrect calculation of how many struct pages require initialization. This discrepancy results in only a subset of the necessary struct pages being properly initialized while the remaining tail pages retain uninitialized state, creating potential memory corruption scenarios and system instability. The vulnerability represents a classic case of improper state management where assumptions about memory layout optimization are not consistently applied across all code paths.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially cause system crashes or unpredictable behavior during runtime operations involving DAX memory hotplug functionality. When the uninitialized struct pages are subsequently accessed by the kernel's memory management routines, they may contain garbage data that leads to incorrect memory allocation decisions, page table manipulations, or other critical errors. This issue particularly affects systems running with DAX enabled and utilizing dynamic memory hotplug capabilities, making it relevant for high-performance computing environments, database servers, and applications requiring persistent memory operations. The vulnerability could be exploited by malicious actors to cause denial of service conditions or potentially escalate privileges through carefully crafted memory allocation patterns.
The fix implemented addresses this issue by ensuring that early sections are consistently treated as unoptimized when calculating the number of struct pages that require initialization during hotplug operations. This approach aligns the page initialization logic with the actual memory map structure being processed, eliminating the mismatch between expected and actual optimization states. The solution follows established security principles by ensuring proper initialization of all memory structures and maintaining consistent state assumptions throughout the kernel's memory management code paths. This vulnerability demonstrates the importance of careful consideration of memory layout optimization states in kernel code, particularly when dealing with dynamic memory operations that must maintain consistency across different boot phases and runtime conditions.
This issue relates to CWE-754 which describes improper check for special operating mode, specifically where the system fails to properly validate memory map optimization states during dynamic memory operations. The vulnerability could potentially be leveraged as part of broader attack chains targeting memory management subsystems, though it primarily manifests as a stability and reliability issue rather than a direct privilege escalation vector. The fix ensures that all struct pages are properly initialized regardless of optimization state, aligning with the principle of least privilege and proper resource management in kernel space operations.