Linux Kernel CVE-2026-72066

The vulnerability resides in the CPU hotplug subsystem's sysfs interface, specifically the states_show() function, which iterates all registered CPU hotplug state names and concatenates them into a single kernel sysfs output buffer using sprintf(). The sysfs layer allocates exactly one PAGE_SIZE (typically 4096 bytes) for such buffers; sprintf() performs no bounds checking against this limit. When the cumulative length of registered hotplug state name strings exceeds PAGE_SIZE - possible on kernels compiled with many drivers or subsystems that register hotplug callbacks - the write operation spills past the buffer boundary into adjacent kernel memory. The fix replaces sprintf() with sysfs_emit_at(), which is bounds-aware and enforces the PAGE_SIZE ceiling. While CWE is listed as N/A in the source data, the structural root cause is an out-of-bounds write (CWE-787), and the 'Information Disclosure' tag in the source data likely understates impact since kernel memory corruption can facilitate privilege escalation. The vulnerability traces back to commit 98f8cdce1db580b99fce823a48eea2cb2bdb261e, present since Linux 4.6.