Out-of-bounds write in Linux kernel - CVE-2026-72212
Published: August 16, 2026
Vulnerability identifier: #VU143389
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72212
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to memory corruption in create_altmaps_and_memory_blocks() in mm/memory_hotplug.c when handling a failure after successful memory addition with memmap_on_memory enabled. A local user can trigger this error path to cause a denial of service or execute arbitrary code.
The issue occurs because vmemmap pages allocated from an altmap may be freed into the system buddy allocator before the physical linear mapping for that memory is destroyed.
Affected software
Linux kernel
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
Ubuntu
linux-gcp-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
How to mitigate CVE-2026-72212
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1