SB20260816325 - Out-of-bounds write in Linux kernel mm

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-72212)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to memory corruption in create_altmaps_and_memory_blocks() in mm/memory_hotplug.c when handling a failure after successful memory addition with memmap_on_memory enabled. A local user can trigger this error path to cause a denial of service or execute arbitrary code.

The issue occurs because vmemmap pages allocated from an altmap may be freed into the system buddy allocator before the physical linear mapping for that memory is destroyed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2f9e3ec17c3d2093c664c00a027588a446c39894
• https://git.kernel.org/stable/c/2fac4afa0e2e68841334c78c1821e49f74fbc66a
• https://git.kernel.org/stable/c/3833e6abdbbfb59ec8203a84a84206cb7ffb41ac
• https://git.kernel.org/stable/c/722e6c54bde6391fb95f0357f555aca887c7b18c