{"id":"CVE-2026-72172","state":"PUBLISHED","title":"mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mm_init: fix uninitialized struct pages for ZONE_DEVICE\n\nIf DAX memory is hotplugged into an unoccupied subsection of an early\nsection, section_activate() reuses the unoptimized boot memmap.  However,\ncompound_nr_pages() still assumes that vmemmap optimization is in effect\nand initializes only the reduced number of struct pages.  As a result, the\nremaining tail struct pages are left uninitialized, which can later lead\nto unexpected behavior or crashes.\n\nFix this by treating early sections as unoptimized when calculating how\nmany struct pages to initialize.","publishedAt":"2026-08-15T05:53:37.795Z","updatedAt":"2026-10-16T18:45:00.307Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"c5ef574d57e4a701485c13f26822328c91f05413","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"511a60e71aec308b24722cffc1912bf6befb87bf","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"da5234df0941665f3a3f5b80f3dab94046537be0","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"b91e27bce37cab9f35de0059278ebe457ca9878b","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"cd681403a87085562499d60325b7b45d3be11217","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/mm_init.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/mm_init.c"]}],"references":["https://git.kernel.org/stable/c/c5ef574d57e4a701485c13f26822328c91f05413","https://git.kernel.org/stable/c/511a60e71aec308b24722cffc1912bf6befb87bf","https://git.kernel.org/stable/c/11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6","https://git.kernel.org/stable/c/da5234df0941665f3a3f5b80f3dab94046537be0","https://git.kernel.org/stable/c/b91e27bce37cab9f35de0059278ebe457ca9878b","https://git.kernel.org/stable/c/cd681403a87085562499d60325b7b45d3be11217"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/72xxx/CVE-2026-72172.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72172","state":"PUBLISHED","datePublished":"2026-08-15T05:53:37.795Z","dateUpdated":"2026-10-16T18:45:00.307Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-09T03:40:39.910Z"},"containers":{"cna":{"title":"mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mm_init: fix uninitialized struct pages for ZONE_DEVICE\n\nIf DAX memory is hotplugged into an unoccupied subsection of an early\nsection, section_activate() reuses the unoptimized boot memmap.  However,\ncompound_nr_pages() still assumes that vmemmap optimization is in effect\nand initializes only the reduced number of struct pages.  As a result, the\nremaining tail struct pages are left uninitialized, which can later lead\nto unexpected behavior or crashes.\n\nFix this by treating early sections as unoptimized when calculating how\nmany struct pages to initialize."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"c5ef574d57e4a701485c13f26822328c91f05413","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"511a60e71aec308b24722cffc1912bf6befb87bf","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"da5234df0941665f3a3f5b80f3dab94046537be0","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"b91e27bce37cab9f35de0059278ebe457ca9878b","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","status":"affected","lessThan":"cd681403a87085562499d60325b7b45d3be11217","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/mm_init.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.1.184","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/mm_init.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/c5ef574d57e4a701485c13f26822328c91f05413"},{"url":"https://git.kernel.org/stable/c/511a60e71aec308b24722cffc1912bf6befb87bf"},{"url":"https://git.kernel.org/stable/c/11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6"},{"url":"https://git.kernel.org/stable/c/da5234df0941665f3a3f5b80f3dab94046537be0"},{"url":"https://git.kernel.org/stable/c/b91e27bce37cab9f35de0059278ebe457ca9878b"},{"url":"https://git.kernel.org/stable/c/cd681403a87085562499d60325b7b45d3be11217"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in memmap_init_zone_device() reached via memremap_pages()/devm_memremap_pages() during device-DAX driver probe or ZONE_DEVICE hotplug (e.g., dev_dax_probe, Hyper-V VTL), not via network protocols; subsequent impact is triggered by local mmap/page-fault/get_user_pages activity on the DAX device.\nAC:L - After device-DAX with compound vmemmap (vmemmap_shift>0) is hotplugged into an unoccupied early-section subsection, uninitialized tail struct pages remain indefinitely; an attacker only needs to access that memory (e.g., mmap /dev/dax) to invoke kernel page-metadata operations, without races or uncontrollable victim state.\nPR:L - While initial ZONE_DEVICE hotplug requires administrator device-DAX configuration (daxctl/ndctl, driver bind), on a configured persistent-memory or cloud server unprivileged local users with /dev/dax access can trigger kernel use of the corrupt struct pages via mmap and page faults without CAP_SYS_ADMIN in the init namespace.\nUI:N - Exploitation requires no victim interaction beyond the attacker (or any local user) running programs that mmap or access the already-provisioned DAX device; no mount, click, or plug/unplug action by another user is needed at exploit time.\nS:U - Impact is kernel memory corruption, information disclosure, and denial of service within the host kernel security boundary; it does not inherently cross VM/host, IOMMU, or sandbox isolation even though cloud persistent-memory deployments are a plausible high-impact scenario.\nC:H - Uninitialized tail struct page metadata (flags, refcount, pgmap/lru fields) is later interpreted as valid by the MM subsystem; garbage contents can be read through page-table walks, refcount checks, and folio lookups, yielding kernel memory disclosure comparable to other uninitialized-page corruption bugs.\nI:H - Corrupt struct page fields can drive incorrect refcounting, compound-head/tail linkage, and ZONE_DEVICE pgmap handling, enabling heap-style memory corruption and potential arbitrary kernel write or control-flow hijack, not merely bounded data modification.\nA:H - The fix commit and call path explicitly warn of unexpected behavior and crashes; operations on uninitialized struct pages can provoke kernel oops, BUG_ON, use-after-free, or panic during page allocation, migration, or DAX fault handling, giving reliable denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-23T12:47:00.343Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-72172","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T18:43:19.574652Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T18:45:00.307Z"}}]}}}