CVE-2026-72172

High

Description

In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE If DAX memory is hotplugged into an unoccupied subsection of an early section, section_activate() reuses the unoptimized boot memmap. However, compound_nr_pages() still assumes that vmemmap optimization is in effect and initializes only the reduced number of struct pages. As a result, the remaining tail struct pages are left uninitialized, which can later lead to unexpected behavior or crashes. Fix this by treating early sections as unoptimized when calculating how many struct pages to initialize.

SeverityHigh
CVSS7.8
Exploit probability—
ProductLinux
PublishedAug 15, 2026
First seenAug 15, 2026

How to fix

Update
  • Linux Linuxc5ef574d57e4a701485c13f26822328c91f05413, 511a60e71aec308b24722cffc1912bf6befb87bf, 11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6, da5234df0941665f3a3f5b80f3dab94046537be0, b91e27bce37cab9f35de0059278ebe457ca9878b, cd681403a87085562499d60325b7b45d3be11217 or later

Affected products

ProductAffected versionsFixed in
Linux Linux6fd3620b342861de9547ea01d28f664892ef51a1 ≤ v < c5ef574d57e4a701485c13f26822328c91f05413, 6fd3620b342861de9547ea01d28f664892ef51a1 ≤ v < 511a60e71aec308b24722cffc1912bf6befb87bf, 6fd3620b342861de9547ea01d28f664892ef51a1 ≤ v < 11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6, 6fd3620b342861de9547ea01d28f664892ef51a1 ≤ v < da5234df0941665f3a3f5b80f3dab94046537be0, 6fd3620b342861de9547ea01d28f664892ef51a1 ≤ v < b91e27bce37cab9f35de0059278ebe457ca9878b, 6fd3620b342861de9547ea01d28f664892ef51a1 ≤ v < cd681403a87085562499d60325b7b45d3be11217, 5.19c5ef574d57e4a701485c13f26822328c91f05413, 511a60e71aec308b24722cffc1912bf6befb87bf, 11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6, da5234df0941665f3a3f5b80f3dab94046537be0, b91e27bce37cab9f35de0059278ebe457ca9878b, cd681403a87085562499d60325b7b45d3be11217

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.

CVE-2026-72172 · Linux · Dark Radar