« Volver al listado

CVE-2026-93172

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug

We miss a failed allocation check for pgdat->per_cpu_nodestats, which results in a NULL deref when we offset into the per-cpu area.

Propagate -ENOMEM up the stack and leave per_cpu_nodestats pointing at boot_nodestats so a later online can retry the allocation.

hotadd_init_pgdat() returns NULL on failure, which __try_online_node() already maps to -ENOMEM.

Detalles técnicos trazas, registros y código del informe original
On failure nothing needs to be unwound:
  - the node is never marked online
  - per_cpu_nodestats is left pointing at boot_nodestats
  - __add_memory_resource() cleans up pending memblock resources
  - later online attempts retry the per_cpu_nodestats allocation

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93172",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "75ef7184053989118d3814c558a9af62e7376a58",
              "lessThan": "4cc5caef9a8d1894dfa31d84a0daa0ac1437dadc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75ef7184053989118d3814c558a9af62e7376a58",
              "lessThan": "bc3b5e6519b8df22d622a03eab6772784da97db4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75ef7184053989118d3814c558a9af62e7376a58",
              "lessThan": "1017fe1c7f48e511c5a680e3057005daaff2f3a2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75ef7184053989118d3814c558a9af62e7376a58",
              "lessThan": "2ebce860bdd7ae5e13002811bc9bbbf33fcfc221",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/linux/memory_hotplug.h",
            "mm/memory_hotplug.c",
            "mm/mm_init.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/linux/memory_hotplug.h",
            "mm/memory_hotplug.c",
            "mm/mm_init.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:18:12.943",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1017fe1c7f48e511c5a680e3057005daaff2f3a2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2ebce860bdd7ae5e13002811bc9bbbf33fcfc221",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4cc5caef9a8d1894dfa31d84a0daa0ac1437dadc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bc3b5e6519b8df22d622a03eab6772784da97db4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug\n\nWe miss a failed allocation check for pgdat->per_cpu_nodestats, which\nresults in a NULL deref when we offset into the per-cpu area.\n\nPropagate -ENOMEM up the stack and leave per_cpu_nodestats pointing\nat boot_nodestats so a later online can retry the allocation.\n\nhotadd_init_pgdat() returns NULL on failure, which __try_online_node()\nalready maps to -ENOMEM.\n\nOn failure nothing needs to be unwound:\n  - the node is never marked online\n  - per_cpu_nodestats is left pointing at boot_nodestats\n  - __add_memory_resource() cleans up pending memblock resources\n  - later online attempts retry the per_cpu_nodestats allocation"
    }
  ],
  "lastModified": "2026-09-17T17:18:12.943",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}