---
id: CVE-2026-72066
title: 'cpu: hotplug: Bound hotplug states sysfs output'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cpu: hotplug: Bound hotplug states sysfs output

  states_show() adds CPU hotplug state names into a single sysfs buffer
  using sprintf(). With enough registered states, t…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e <
    27481cf4365a6ff5c9be3590143e7ed434000266
  - >-
    Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e <
    2408be459c70ef4250da1a9e50f5478e6b250d61
  - >-
    Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e <
    de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635
  - >-
    Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e <
    998f66e9ce320f3433f60b948e3698b744754a46
  - >-
    Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e <
    61a73a123ac7a7fbc57382531f8cb7092d569aba
  - >-
    Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e <
    6cb15b81ff545840048fb0e1a6e827d560dbf367
  - >-
    Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e <
    631d53102da9f469c96b882b770336bec095b833
  - >-
    Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e <
    86f436567f2516a0083b210bedc933544826a2c3
  - Linux 4.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:51:15.720754Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:19.315Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72066'
references:
  - url: 'https://git.kernel.org/stable/c/27481cf4365a6ff5c9be3590143e7ed434000266'
  - url: 'https://git.kernel.org/stable/c/2408be459c70ef4250da1a9e50f5478e6b250d61'
  - url: 'https://git.kernel.org/stable/c/de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635'
  - url: 'https://git.kernel.org/stable/c/998f66e9ce320f3433f60b948e3698b744754a46'
  - url: 'https://git.kernel.org/stable/c/61a73a123ac7a7fbc57382531f8cb7092d569aba'
  - url: 'https://git.kernel.org/stable/c/6cb15b81ff545840048fb0e1a6e827d560dbf367'
  - url: 'https://git.kernel.org/stable/c/631d53102da9f469c96b882b770336bec095b833'
  - url: 'https://git.kernel.org/stable/c/86f436567f2516a0083b210bedc933544826a2c3'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06683
ingestedAt: '2026-10-16T17:24:46.875Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cpu: hotplug: Bound hotplug states sysfs output

states_show() adds CPU hotplug state names into a single sysfs buffer
using sprintf(). With enough registered states, this can write past the
end of the PAGE_SIZE buffer.

Use sysfs_emit_at() so output is bounded.

## Affected

- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 27481cf4365a6ff5c9be3590143e7ed434000266`
- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 2408be459c70ef4250da1a9e50f5478e6b250d61`
- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635`
- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 998f66e9ce320f3433f60b948e3698b744754a46`
- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 61a73a123ac7a7fbc57382531f8cb7092d569aba`
- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 6cb15b81ff545840048fb0e1a6e827d560dbf367`
- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 631d53102da9f469c96b882b770336bec095b833`
- `Linux >= 98f8cdce1db580b99fce823a48eea2cb2bdb261e < 86f436567f2516a0083b210bedc933544826a2c3`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.