CVE-2026-72212

In the Linux kernel, the following vulnerability has been resolved:

mm/memory_hotplug: fix incorrect altmap passing in error path

In createaltmapsandmemoryblocks(), when archaddmemory() succeeds with memmaponmemory enabled, the vmemmap pages are allocated from params.altmap. If creatememoryblockdevices() subsequently fails, the error path calls archremove_memory() with a NULL altmap instead of params.altmap.

This is a bug that could lead to memory corruption. Since altmap is NULL, vmemmapfree() falls back to freeing the vmemmap pages into the system buddy allocator via freepages() instead of the altmap. archremovememory() then immediately destroys the physical linear mapping for this memory. This injects unowned pages into the buddy allocator, causing machine checks or memory corruption if the system later attempts to allocate and use those freed pages.

Fix this by passing params.altmap to archremovememory() in the error path.