CVE-2026-93172

CVE CVE-2026-93172EUVD EUVD-2026-82280Published 2026-09-17T16:12:02.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug We miss a failed allocation check for pgdat->per_cpu_nodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and leave per_cpu_nodestats pointing at boot_nodestats so a later online can retry the allocation. hotadd_init_pgdat() returns NULL on failure, which __try_online_node() already maps to -ENOMEM. On failure nothing needs to be unwound: - the node is never marked online - per_cpu_nodestats is left pointing at boot_nodestats - __add_memory_resource() cleans up pending memblock resources - later online attempts retry the per_cpu_nodestats allocation

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 6.12.110; patch: 0; 4.8; patch: 7.2.6; 75ef7184053989118d3814c558a9af62e7376a58 <1017fe1c7f48e511c5a680e3057005daaff2f3a2; 75ef7184053989118d3814c558a9af62e7376a58 <bc3b5e6519b8df22d622a03eab6772784da97db4; patch: 7.3-rc1; 75ef7184053989118d3814c558a9af62e7376a58 <2ebce860bdd7ae5e13002811bc9bbbf33fcfc221; patch: 6.18.52; 75ef7184053989118d3814c558a9af62e7376a58 <4cc5caef9a8d1894dfa31d84a0daa0ac1437dadc

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.