CVE-2026-93172 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
We miss a failed allocation check for pgdat->per_cpu_nodestats, which results in a NULL deref when we offset into the per-cpu area.
Propagate -ENOMEM up the stack and leave per_cpu_nodestats pointing at boot_nodestats so a later online can retry the allocation.
hotadd_init_pgdat() returns NULL on failure, which __try_online_node() already maps to -ENOMEM.
On failure nothing needs to be unwound: - the node is never marked online - per_cpu_nodestats is left pointing at boot_nodestats - __add_memory_resource() cleans up pending memblock resources - later online attempts retry the per_cpu_nodestats allocation
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified in mm/mm_init addresses a critical NULL pointer dereference that occurs during the initialization of memory nodes, specifically within the free_area_init_core_hotplug function. This flaw stems from an oversight in error handling logic where the code fails to verify whether the dynamic allocation for pgdat->per_cpu_nodestats was successful before attempting to use it. In systems with hot-pluggable memory or CPU resources, the kernel dynamically allocates per-CPU data structures to manage node-specific statistics and state. When this allocation request returns a failure indicator due to insufficient memory availability, the subsequent code proceeds to calculate offsets into what is expected to be a valid pointer but is actually NULL. This leads to an immediate crash of the kernel as it attempts to access invalid memory addresses, resulting in a system panic or undefined behavior that can compromise the stability and availability of the entire operating environment.
From a technical perspective, this issue represents a classic example of improper input validation regarding internal resource allocation outcomes, which aligns with CWE-476: NULL Pointer Dereference. The vulnerability is particularly dangerous because it occurs during runtime operations such as memory hot-add or CPU online events, rather than just at boot time where resources are typically more predictable and abundant. An attacker who can influence the system's memory pressure conditions might trigger this failure path by exhausting available kernel memory allocations, thereby causing a denial of service against the host machine. The lack of defensive checks allows the execution flow to continue into unsafe territory without any mechanism to detect or gracefully handle the resource exhaustion scenario that preceded it.
The operational impact of this vulnerability is severe, primarily manifesting as a system crash when hot-plug operations are attempted under memory-constrained conditions. Since the kernel does not unwind state on failure because the node was never marked online and cleanup routines like __add_memory_resource() handle pending resources, the immediate consequence is limited to the loss of availability for that specific operation. However, repeated attempts or automated scripts triggering such events could lead to frequent system reboots, disrupting services running on the affected Linux instance. This affects both physical servers with dynamic memory configurations and virtualized environments where resource limits might be tightly enforced by hypervisors, potentially leading to cascading failures in clustered deployments if multiple nodes experience similar crashes simultaneously due to shared resource constraints.
To mitigate this risk, the resolution involves propagating the -ENOMEM error code up the call stack instead of proceeding with a NULL pointer. Crucially, the fix ensures that per_cpu_nodestats is left pointing at boot_nodestats rather than remaining uninitialized or null. This design choice allows subsequent online attempts to retry the allocation safely using the temporary fallback storage provided by boot_nodestats until sufficient memory becomes available for proper dynamic allocation. This approach maintains system stability during transient resource shortages and prevents crashes while preserving the ability to recover gracefully from allocation failures. Administrators should ensure that their Linux kernels are updated with this patch, particularly in environments where hot-plug operations are common or where memory limits might be frequently reached. Monitoring kernel logs for out-of-memory conditions related to per-CPU allocations can also help identify systems at risk before a crash occurs.