Bug 2516567 (CVE-2026-72172)

Summary: CVE-2026-72172 kernel: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel. When Direct Access (DAX) memory is hotplugged, certain internal memory structures (`struct pages`) may not be fully initialized. This uninitialized state can lead to unexpected system behavior or crashes, potentially resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:19:20 UTC 
In the Linux kernel, the following vulnerability has been resolved:

mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE

If DAX memory is hotplugged into an unoccupied subsection of an early
section, section_activate() reuses the unoptimized boot memmap.  However,
compound_nr_pages() still assumes that vmemmap optimization is in effect
and initializes only the reduced number of struct pages.  As a result, the
remaining tail struct pages are left uninitialized, which can later lead
to unexpected behavior or crashes.

Fix this by treating early sections as unoptimized when calculating how
many struct pages to initialize.
Comment 1 Keith Grant 2026-08-18 13:53:27 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081538-CVE-2026-72172-c8f2@gregkh/T