CVE-2026-72010

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: rebind mm mempolicy to effectivemems, not memsallowed

Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOLFRELATIVE_NODES rebinds in response to a CPU hotplug event.

Reproduction steps: 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems) 2) Move the task into the child cpuset 3) Create a VMA mempolicy for that task with MPOLFRELATIVENODES 4) unplug and hotplug a cpu echo 0 > /sys/devices/system/cpu/cpu1/online echo 1 > /sys/devices/system/cpu/cpu1/online 5) mempolicy rebind does a div/0 in mpolrelative_nodemask on the call to _nodesfold()

The cpuset code passes (cs->memsallowed) which is not guaranteed to have nodes to the rebind routine. Use cs->effectivemems instead, which is guaranteed to have a non-empty nodemask once we reach that code path.

[ david: add a comment, slightly rephrase description ]