---
id: CVE-2026-72067
title: 'cpu: hotplug: Preserve per instance callback errors'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cpu: hotplug: Preserve per instance callback errors

  cpuhp_invoke_callback() unwinds earlier callbacks for the same
  hotplug state when one instance fails. The rollback …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 724a86881d03ee5794148e65142e24ed3621be66 <
    fe9c8d641f6991614d1229a3ffd3e33b879bba9c
  - >-
    Linux >= 724a86881d03ee5794148e65142e24ed3621be66 <
    ef39758637cc5b603fb05b625c45a98aa306e338
  - >-
    Linux >= 724a86881d03ee5794148e65142e24ed3621be66 <
    95232281512b15338549171ed9a2acf21f946ffb
  - >-
    Linux >= 724a86881d03ee5794148e65142e24ed3621be66 <
    7a68257b90d8a9b6d605abc99469ded45ecba63b
  - >-
    Linux >= 724a86881d03ee5794148e65142e24ed3621be66 <
    77d4fa8a3ea1c3e8b996ac35e59aee9e77389905
  - >-
    Linux >= 724a86881d03ee5794148e65142e24ed3621be66 <
    f77117530fc3f5932ffb107182a6dd34006be9b6
  - >-
    Linux >= 724a86881d03ee5794148e65142e24ed3621be66 <
    9f7dc355f62c011e4afe8286cf71130d4bfb9d80
  - >-
    Linux >= 724a86881d03ee5794148e65142e24ed3621be66 <
    673db10729fb121ea1b16fe57791a0cb9eac1eb5
  - Linux 4.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:51:18.639735Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:19.472Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72067'
references:
  - url: 'https://git.kernel.org/stable/c/fe9c8d641f6991614d1229a3ffd3e33b879bba9c'
  - url: 'https://git.kernel.org/stable/c/ef39758637cc5b603fb05b625c45a98aa306e338'
  - url: 'https://git.kernel.org/stable/c/95232281512b15338549171ed9a2acf21f946ffb'
  - url: 'https://git.kernel.org/stable/c/7a68257b90d8a9b6d605abc99469ded45ecba63b'
  - url: 'https://git.kernel.org/stable/c/77d4fa8a3ea1c3e8b996ac35e59aee9e77389905'
  - url: 'https://git.kernel.org/stable/c/f77117530fc3f5932ffb107182a6dd34006be9b6'
  - url: 'https://git.kernel.org/stable/c/9f7dc355f62c011e4afe8286cf71130d4bfb9d80'
  - url: 'https://git.kernel.org/stable/c/673db10729fb121ea1b16fe57791a0cb9eac1eb5'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06681
ingestedAt: '2026-10-16T17:24:46.876Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cpu: hotplug: Preserve per instance callback errors

cpuhp_invoke_callback() unwinds earlier callbacks for the same
hotplug state when one instance fails. The rollback path currently
reuses ret, so a successful rollback can hide the original error and
make the failed transition look successful.

Keep the rollback result separate from the original error.

## Affected

- `Linux >= 724a86881d03ee5794148e65142e24ed3621be66 < fe9c8d641f6991614d1229a3ffd3e33b879bba9c`
- `Linux >= 724a86881d03ee5794148e65142e24ed3621be66 < ef39758637cc5b603fb05b625c45a98aa306e338`
- `Linux >= 724a86881d03ee5794148e65142e24ed3621be66 < 95232281512b15338549171ed9a2acf21f946ffb`
- `Linux >= 724a86881d03ee5794148e65142e24ed3621be66 < 7a68257b90d8a9b6d605abc99469ded45ecba63b`
- `Linux >= 724a86881d03ee5794148e65142e24ed3621be66 < 77d4fa8a3ea1c3e8b996ac35e59aee9e77389905`
- `Linux >= 724a86881d03ee5794148e65142e24ed3621be66 < f77117530fc3f5932ffb107182a6dd34006be9b6`
- `Linux >= 724a86881d03ee5794148e65142e24ed3621be66 < 9f7dc355f62c011e4afe8286cf71130d4bfb9d80`
- `Linux >= 724a86881d03ee5794148e65142e24ed3621be66 < 673db10729fb121ea1b16fe57791a0cb9eac1eb5`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.