CVE-2026-93172 is a vulnerability in Linux Kernel
Published on September 17, 2026
mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
In the Linux kernel, the following vulnerability has been resolved:
mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
We miss a failed allocation check for pgdat->per_cpu_nodestats, which
results in a NULL deref when we offset into the per-cpu area.
Propagate -ENOMEM up the stack and leave per_cpu_nodestats pointing
at boot_nodestats so a later online can retry the allocation.
hotadd_init_pgdat() returns NULL on failure, which __try_online_node()
already maps to -ENOMEM.
On failure nothing needs to be unwound:
- the node is never marked online
- per_cpu_nodestats is left pointing at boot_nodestats
- __add_memory_resource() cleans up pending memblock resources
- later online attempts retry the per_cpu_nodestats allocation
Products Associated with CVE-2026-93172
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 75ef7184053989118d3814c558a9af62e7376a58 and below 4cc5caef9a8d1894dfa31d84a0daa0ac1437dadc is affected.
- Version 75ef7184053989118d3814c558a9af62e7376a58 and below bc3b5e6519b8df22d622a03eab6772784da97db4 is affected.
- Version 75ef7184053989118d3814c558a9af62e7376a58 and below 1017fe1c7f48e511c5a680e3057005daaff2f3a2 is affected.
- Version 75ef7184053989118d3814c558a9af62e7376a58 and below 2ebce860bdd7ae5e13002811bc9bbbf33fcfc221 is affected.
- Version 4.8 is affected.
- Before 4.8 is unaffected.
- Version 6.12.110, <= 6.12.* is unaffected.
- Version 6.18.52, <= 6.18.* is unaffected.
- Version 7.2.6, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.