CVE-2026-93172

Summary

In the Linux kernel, the following vulnerability has been resolved:

mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug

We miss a failed allocation check for pgdat->per_cpu_nodestats, which results in a NULL deref when we offset into the per-cpu area.

Propagate -ENOMEM up the stack and leave per_cpu_nodestats pointing at boot_nodestats so a later online can retry the allocation.

hotadd_init_pgdat() returns NULL on failure, which __try_online_node() already maps to -ENOMEM.

On failure nothing needs to be unwound:

  • the node is never marked online
  • per_cpu_nodestats is left pointing at boot_nodestats
  • __add_memory_resource() cleans up pending memblock resources
  • later online attempts retry the per_cpu_nodestats allocation

Affected Software

VendorProductVersion RangeStatus
LinuxLinux75ef7184053989118d3814c558a9af62e7376a58 < 4cc5caef9a8d1894dfa31d84a0daa0ac1437dadcaffected
LinuxLinux75ef7184053989118d3814c558a9af62e7376a58 < bc3b5e6519b8df22d622a03eab6772784da97db4affected
LinuxLinux75ef7184053989118d3814c558a9af62e7376a58 < 1017fe1c7f48e511c5a680e3057005daaff2f3a2affected
LinuxLinux75ef7184053989118d3814c558a9af62e7376a58 < 2ebce860bdd7ae5e13002811bc9bbbf33fcfc221affected
LinuxLinux4.8affected
LinuxLinux0 < 4.8unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References