CVE-2026-72181

mips: sched: Fix CPUMASK_OFFSTACK memory corruption

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Aug 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mips: sched: Fix CPUMASK_OFFSTACK memory corruption

This patch addresses a critical memory management flaw. When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer. Consequently, sizeof(new_mask) evaluates to the pointer size, causing copy_from_user() to clobber the mask pointer. Furthermore, the old logic performed copy_from_user() before allocating the mask.

Fix this by allocating new_mask first. To handle variable-sized user masks correctly, use cpumask_size() to truncate overly large user masks or pad undersized masks with zeros before copying the data directly into the allocated buffer.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 2f7730c03a9deea3ba7a1c980070d363b4ea2046Affected 295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before d20ee42f8226607b5693b2bc2f115ca2d270221aAffected 295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 15ba8053fe4162c933855f1676fb321cdb6251c7Affected 295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 3446ffb5d03c36f9ce88ede7ca5be319a2968d96Affected 295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 87a56c1e8e36d06ebe8640432f911538ded7827dAffected 295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 1caee6e084a96ada94658f261ced377d85af3f03Affected 295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before a1dd41d00c57efb1fbc6f361c5f48c9d00cca51cAffected 295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 98e37db4a34d3af3fb2f4648295c25b5e40b20e3Affected
LinuxLinux	2.6.23Affected before 2.6.23Not affected 5.10.265 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 2f7730c03a9deea3ba7a1c980070d363b4ea2046Affected
295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before d20ee42f8226607b5693b2bc2f115ca2d270221aAffected
295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 15ba8053fe4162c933855f1676fb321cdb6251c7Affected
295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 3446ffb5d03c36f9ce88ede7ca5be319a2968d96Affected
295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 87a56c1e8e36d06ebe8640432f911538ded7827dAffected
295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 1caee6e084a96ada94658f261ced377d85af3f03Affected
295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before a1dd41d00c57efb1fbc6f361c5f48c9d00cca51cAffected
295cbf6d63165fe4253cf1d9ceadcda47a318b48 to before 98e37db4a34d3af3fb2f4648295c25b5e40b20e3Affected

LinuxLinux

2.6.23Affected
before 2.6.23Not affected
5.10.265 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.