{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-72172","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-09T03:40:39.910Z","datePublished":"2026-08-15T05:53:37.795Z","dateUpdated":"2026-08-23T12:47:00.343Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-23T12:47:00.343Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mm_init: fix uninitialized struct pages for ZONE_DEVICE\n\nIf DAX memory is hotplugged into an unoccupied subsection of an early\nsection, section_activate() reuses the unoptimized boot memmap.  However,\ncompound_nr_pages() still assumes that vmemmap optimization is in effect\nand initializes only the reduced number of struct pages.  As a result, the\nremaining tail struct pages are left uninitialized, which can later lead\nto unexpected behavior or crashes.\n\nFix this by treating early sections as unoptimized when calculating how\nmany struct pages to initialize."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in memmap_init_zone_device() reached via memremap_pages()/devm_memremap_pages() during device-DAX driver probe or ZONE_DEVICE hotplug (e.g., dev_dax_probe, Hyper-V VTL), not via network protocols; subsequent impact is triggered by local mmap/page-fault/get_user_pages activity on the DAX device.\nAC:L - After device-DAX with compound vmemmap (vmemmap_shift>0) is hotplugged into an unoccupied early-section subsection, uninitialized tail struct pages remain indefinitely; an attacker only needs to access that memory (e.g., mmap /dev/dax) to invoke kernel page-metadata operations, without races or uncontrollable victim state.\nPR:L - While initial ZONE_DEVICE hotplug requires administrator device-DAX configuration (daxctl/ndctl, driver bind), on a configured persistent-memory or cloud server unprivileged local users with /dev/dax access can trigger kernel use of the corrupt struct pages via mmap and page faults without CAP_SYS_ADMIN in the init namespace.\nUI:N - Exploitation requires no victim interaction beyond the attacker (or any local user) running programs that mmap or access the already-provisioned DAX device; no mount, click, or plug/unplug action by another user is needed at exploit time.\nS:U - Impact is kernel memory corruption, information disclosure, and denial of service within the host kernel security boundary; it does not inherently cross VM/host, IOMMU, or sandbox isolation even though cloud persistent-memory deployments are a plausible high-impact scenario.\nC:H - Uninitialized tail struct page metadata (flags, refcount, pgmap/lru fields) is later interpreted as valid by the MM subsystem; garbage contents can be read through page-table walks, refcount checks, and folio lookups, yielding kernel memory disclosure comparable to other uninitialized-page corruption bugs.\nI:H - Corrupt struct page fields can drive incorrect refcounting, compound-head/tail linkage, and ZONE_DEVICE pgmap handling, enabling heap-style memory corruption and potential arbitrary kernel write or control-flow hijack, not merely bounded data modification.\nA:H - The fix commit and call path explicitly warn of unexpected behavior and crashes; operations on uninitialized struct pages can provoke kernel oops, BUG_ON, use-after-free, or panic during page allocation, migration, or DAX fault handling, giving reliable denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/mm_init.c"],"versions":[{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","lessThan":"c5ef574d57e4a701485c13f26822328c91f05413","status":"affected","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","lessThan":"511a60e71aec308b24722cffc1912bf6befb87bf","status":"affected","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","lessThan":"11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6","status":"affected","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","lessThan":"da5234df0941665f3a3f5b80f3dab94046537be0","status":"affected","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","lessThan":"b91e27bce37cab9f35de0059278ebe457ca9878b","status":"affected","versionType":"git"},{"version":"6fd3620b342861de9547ea01d28f664892ef51a1","lessThan":"cd681403a87085562499d60325b7b45d3be11217","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["mm/mm_init.c"],"versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","status":"unaffected","versionType":"semver"},{"version":"6.1.184","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.184"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c5ef574d57e4a701485c13f26822328c91f05413"},{"url":"https://git.kernel.org/stable/c/511a60e71aec308b24722cffc1912bf6befb87bf"},{"url":"https://git.kernel.org/stable/c/11f2826e9ee6f24aaa774e3dcd75abbe4b3091b6"},{"url":"https://git.kernel.org/stable/c/da5234df0941665f3a3f5b80f3dab94046537be0"},{"url":"https://git.kernel.org/stable/c/b91e27bce37cab9f35de0059278ebe457ca9878b"},{"url":"https://git.kernel.org/stable/c/cd681403a87085562499d60325b7b45d3be11217"}],"title":"mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE","x_generator":{"engine":"bippy-1.2.0"}}}}