vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-72067

cpu: hotplug: Preserve per instance callback errors

HIGH
7.8
CVSS Score
Published: August 15, 2026 at 05:52 AM UTC
Updated: October 19, 2026 at 10:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhp_invoke_callback() unwinds earlier callbacks for the same hotplug state when one instance fails. The rollback path currently reuses ret, so a successful rollback can hide the original error and make the failed transition look successful. Keep the rollback result separate from the original error.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
4.14724a86881d03ee5794148e65142e24ed3621be66
Vendor states this is fixed in 673db10729fb121ea1b16fe57791a0cb9eac1eb5 (fixed)
Vendor states this is fixed in 77d4fa8a3ea1c3e8b996ac35e59aee9e77389905 (fixed)
Vendor states this is fixed in 7a68257b90d8a9b6d605abc99469ded45ecba63b (fixed)
Vendor states this is fixed in 95232281512b15338549171ed9a2acf21f946ffb (fixed)
Vendor states this is fixed in 9f7dc355f62c011e4afe8286cf71130d4bfb9d80 (fixed)
Vendor states this is fixed in ef39758637cc5b603fb05b625c45a98aa306e338 (fixed)
Vendor states this is fixed in f77117530fc3f5932ffb107182a6dd34006be9b6 (fixed)
Vendor states this is fixed in fe9c8d641f6991614d1229a3ffd3e33b879bba9c (fixed)
Vendor states this is fixed in 4.14 (unaffected)
Vendor states this is fixed in 5.10.261 (unaffected)
Vendor states this is fixed in 5.15.212 (unaffected)
Vendor states this is fixed in 6.1.178 (unaffected)
Vendor states this is fixed in 6.12.97 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.145 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/fe9c8d641f6991614d1229a3ffd3e33b879bba9c
Source: cverecord
https://git.kernel.org/stable/c/ef39758637cc5b603fb05b625c45a98aa306e338
Source: cverecord
https://git.kernel.org/stable/c/95232281512b15338549171ed9a2acf21f946ffb
Source: cverecord
https://git.kernel.org/stable/c/7a68257b90d8a9b6d605abc99469ded45ecba63b
Source: cverecord
https://git.kernel.org/stable/c/77d4fa8a3ea1c3e8b996ac35e59aee9e77389905
Source: cverecord
https://git.kernel.org/stable/c/f77117530fc3f5932ffb107182a6dd34006be9b6
Source: cverecord
https://git.kernel.org/stable/c/9f7dc355f62c011e4afe8286cf71130d4bfb9d80
Source: cverecord
https://git.kernel.org/stable/c/673db10729fb121ea1b16fe57791a0cb9eac1eb5

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED
CWE
CWE-754

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card