CVE-2026-72067

cpu: hotplug: Preserve per instance callback errors

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

cpu: hotplug: Preserve per instance callback errors

cpuhp_invoke_callback() unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the original error and make the failed transition look successful.

Keep the rollback result separate from the original error.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-754 Improper Check for Unusual or Exceptional Conditions

Affected Products

Product	Versions
LinuxLinux	724a86881d03ee5794148e65142e24ed3621be66 to before fe9c8d641f6991614d1229a3ffd3e33b879bba9cAffected 724a86881d03ee5794148e65142e24ed3621be66 to before ef39758637cc5b603fb05b625c45a98aa306e338Affected 724a86881d03ee5794148e65142e24ed3621be66 to before 95232281512b15338549171ed9a2acf21f946ffbAffected 724a86881d03ee5794148e65142e24ed3621be66 to before 7a68257b90d8a9b6d605abc99469ded45ecba63bAffected 724a86881d03ee5794148e65142e24ed3621be66 to before 77d4fa8a3ea1c3e8b996ac35e59aee9e77389905Affected 724a86881d03ee5794148e65142e24ed3621be66 to before f77117530fc3f5932ffb107182a6dd34006be9b6Affected 724a86881d03ee5794148e65142e24ed3621be66 to before 9f7dc355f62c011e4afe8286cf71130d4bfb9d80Affected 724a86881d03ee5794148e65142e24ed3621be66 to before 673db10729fb121ea1b16fe57791a0cb9eac1eb5Affected
LinuxLinux	4.14Affected before 4.14Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

724a86881d03ee5794148e65142e24ed3621be66 to before fe9c8d641f6991614d1229a3ffd3e33b879bba9cAffected
724a86881d03ee5794148e65142e24ed3621be66 to before ef39758637cc5b603fb05b625c45a98aa306e338Affected
724a86881d03ee5794148e65142e24ed3621be66 to before 95232281512b15338549171ed9a2acf21f946ffbAffected
724a86881d03ee5794148e65142e24ed3621be66 to before 7a68257b90d8a9b6d605abc99469ded45ecba63bAffected
724a86881d03ee5794148e65142e24ed3621be66 to before 77d4fa8a3ea1c3e8b996ac35e59aee9e77389905Affected
724a86881d03ee5794148e65142e24ed3621be66 to before f77117530fc3f5932ffb107182a6dd34006be9b6Affected
724a86881d03ee5794148e65142e24ed3621be66 to before 9f7dc355f62c011e4afe8286cf71130d4bfb9d80Affected
724a86881d03ee5794148e65142e24ed3621be66 to before 673db10729fb121ea1b16fe57791a0cb9eac1eb5Affected

LinuxLinux

4.14Affected
before 4.14Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.