GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-72010

Vulnerability from fkie_nvd - Published: 2026-08-15 06:20 - Updated: 2026-08-17 06:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a CPU hotplug event. Reproduction steps: 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems) 2) Move the task into the child cpuset 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES 4) unplug and hotplug a cpu echo 0 > /sys/devices/system/cpu/cpu1/online echo 1 > /sys/devices/system/cpu/cpu1/online 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the call to __nodes_fold() The cpuset code passes (cs->mems_allowed) which is not guaranteed to have nodes to the rebind routine. Use cs->effective_mems instead, which is guaranteed to have a non-empty nodemask once we reach that code path. [ david: add a comment, slightly rephrase description ]
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/02f67c4f88be8e3dbd91951d13cdcc5bcc82e9c7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4b06449384b9ee5b3372bab60601ba5cd4162086
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b7adeba2a21c98c7b20f18e27e3ead86bdb5e08d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b983c56426383e4a06fa5970c4e33cee879b1482
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c17f06d8a085d6be58b544a440ce243f5e441a60
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c844b7d9a9586de15dd28c06da5cc7f6ab28787d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fc680afc510157f6b137956011c09abc23eb0842
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fcc8c310539c3cc523419113b227161a96b50550
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/cgroup/cpuset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7adeba2a21c98c7b20f18e27e3ead86bdb5e08d",
              "status": "affected",
              "version": "ae1c802382f7af60aa54879fb4f5920a9df1ff48",
              "versionType": "git"
            },
            {
              "lessThan": "fcc8c310539c3cc523419113b227161a96b50550",
              "status": "affected",
              "version": "ae1c802382f7af60aa54879fb4f5920a9df1ff48",
              "versionType": "git"
            },
            {
              "lessThan": "4b06449384b9ee5b3372bab60601ba5cd4162086",
              "status": "affected",
              "version": "ae1c802382f7af60aa54879fb4f5920a9df1ff48",
              "versionType": "git"
            },
            {
              "lessThan": "02f67c4f88be8e3dbd91951d13cdcc5bcc82e9c7",
              "status": "affected",
              "version": "ae1c802382f7af60aa54879fb4f5920a9df1ff48",
              "versionType": "git"
            },
            {
              "lessThan": "fc680afc510157f6b137956011c09abc23eb0842",
              "status": "affected",
              "version": "ae1c802382f7af60aa54879fb4f5920a9df1ff48",
              "versionType": "git"
            },
            {
              "lessThan": "c844b7d9a9586de15dd28c06da5cc7f6ab28787d",
              "status": "affected",
              "version": "ae1c802382f7af60aa54879fb4f5920a9df1ff48",
              "versionType": "git"
            },
            {
              "lessThan": "c17f06d8a085d6be58b544a440ce243f5e441a60",
              "status": "affected",
              "version": "ae1c802382f7af60aa54879fb4f5920a9df1ff48",
              "versionType": "git"
            },
            {
              "lessThan": "b983c56426383e4a06fa5970c4e33cee879b1482",
              "status": "affected",
              "version": "ae1c802382f7af60aa54879fb4f5920a9df1ff48",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/cgroup/cpuset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed\n\nCreating a child cpuset where cpuset.mems is never set leads to a div/0\nwhen a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a\nCPU hotplug event.\n\nReproduction steps:\n 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems)\n 2) Move the task into the child cpuset\n 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES\n 4) unplug and hotplug a cpu\n      echo 0 \u003e /sys/devices/system/cpu/cpu1/online\n      echo 1 \u003e /sys/devices/system/cpu/cpu1/online\n 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the\n    call to __nodes_fold()\n\nThe cpuset code passes (cs-\u003emems_allowed) which is not guaranteed to have\nnodes to the rebind routine.  Use cs-\u003eeffective_mems instead, which is\nguaranteed to have a non-empty nodemask once we reach that code path.\n\n[ david: add a comment, slightly rephrase description ]"
    }
  ],
  "id": "CVE-2026-72010",
  "lastModified": "2026-08-17T06:17:58.447",
  "metrics": {},
  "published": "2026-08-15T06:20:59.670",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/02f67c4f88be8e3dbd91951d13cdcc5bcc82e9c7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4b06449384b9ee5b3372bab60601ba5cd4162086"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b7adeba2a21c98c7b20f18e27e3ead86bdb5e08d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b983c56426383e4a06fa5970c4e33cee879b1482"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c17f06d8a085d6be58b544a440ce243f5e441a60"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c844b7d9a9586de15dd28c06da5cc7f6ab28787d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fc680afc510157f6b137956011c09abc23eb0842"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fcc8c310539c3cc523419113b227161a96b50550"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.