{"id":"CVE-2026-72066","title":"cpu: hotplug: Bound hotplug states sysfs output","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncpu: hotplug: Bound hotplug states sysfs output\n\nstates_show() adds CPU hotplug state names into a single sysfs buffer\nusing sprintf(). With enough registered states, t…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 27481cf4365a6ff5c9be3590143e7ed434000266","Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 2408be459c70ef4250da1a9e50f5478e6b250d61","Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635","Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 998f66e9ce320f3433f60b948e3698b744754a46","Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 61a73a123ac7a7fbc57382531f8cb7092d569aba","Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 6cb15b81ff545840048fb0e1a6e827d560dbf367","Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 631d53102da9f469c96b882b770336bec095b833","Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 86f436567f2516a0083b210bedc933544826a2c3","Linux 4.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:51:15.720754Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:19.315Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72066","references":[{"url":"https://git.kernel.org/stable/c/27481cf4365a6ff5c9be3590143e7ed434000266"},{"url":"https://git.kernel.org/stable/c/2408be459c70ef4250da1a9e50f5478e6b250d61"},{"url":"https://git.kernel.org/stable/c/de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635"},{"url":"https://git.kernel.org/stable/c/998f66e9ce320f3433f60b948e3698b744754a46"},{"url":"https://git.kernel.org/stable/c/61a73a123ac7a7fbc57382531f8cb7092d569aba"},{"url":"https://git.kernel.org/stable/c/6cb15b81ff545840048fb0e1a6e827d560dbf367"},{"url":"https://git.kernel.org/stable/c/631d53102da9f469c96b882b770336bec095b833"},{"url":"https://git.kernel.org/stable/c/86f436567f2516a0083b210bedc933544826a2c3"}],"tags":["cve.org"],"epss":0.00176,"epssPercentile":0.06683,"ingestedAt":"2026-10-16T17:24:46.875Z","slug":"CVE-2026-72066","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncpu: hotplug: Bound hotplug states sysfs output\n\nstates_show() adds CPU hotplug state names into a single sysfs buffer\nusing sprintf(). With enough registered states, this can write past the\nend of the PAGE_SIZE buffer.\n\nUse sysfs_emit_at() so output is bounded.\n\n## Affected\n\n- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 27481cf4365a6ff5c9be3590143e7ed434000266`\n- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 2408be459c70ef4250da1a9e50f5478e6b250d61`\n- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635`\n- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 998f66e9ce320f3433f60b948e3698b744754a46`\n- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 61a73a123ac7a7fbc57382531f8cb7092d569aba`\n- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 6cb15b81ff545840048fb0e1a6e827d560dbf367`\n- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 631d53102da9f469c96b882b770336bec095b833`\n- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 86f436567f2516a0083b210bedc933544826a2c3`\n- `Linux 4.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}