CVE-2026-72172

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72172
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72172.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72172
Downstream
Published
2026-08-15T05:53:37.795Z
Modified
2026-08-18T03:56:21.676323118Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
Details

In the Linux kernel, the following vulnerability has been resolved:

mm/mminit: fix uninitialized struct pages for ZONEDEVICE

If DAX memory is hotplugged into an unoccupied subsection of an early section, sectionactivate() reuses the unoptimized boot memmap. However, compoundnr_pages() still assumes that vmemmap optimization is in effect and initializes only the reduced number of struct pages. As a result, the remaining tail struct pages are left uninitialized, which can later lead to unexpected behavior or crashes.

Fix this by treating early sections as unoptimized when calculating how many struct pages to initialize.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72172.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6fd3620b342861de9547ea01d28f664892ef51a1
Fixed
511a60e71aec308b24722cffc1912bf6befb87bf
Fixed
11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6
Fixed
da5234df0941665f3a3f5b80f3dab94046537be0
Fixed
b91e27bce37cab9f35de0059278ebe457ca9878b
Fixed
cd681403a87085562499d60325b7b45d3be11217

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72172.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.19.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.40
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72172.json"