Linux Kernel CVE-2026-72172

The Linux kernel's ZONE_DEVICE memory zone supports special-purpose memory such as persistent memory (PMEM) and DAX (Direct Access) devices, which allow applications to bypass the page cache and access storage directly. Memory hotplug allows adding physical memory to a running system. The vulnerability is rooted in an inconsistency between two subsystems: section_activate() handles initialization when hotplugged DAX memory lands in an early section (one populated during boot), and in that case it reuses the unoptimized boot memmap rather than the vmemmap-optimized layout. However, compound_nr_pages() - which determines how many struct page descriptors to initialize - still assumes vmemmap optimization is in effect and computes a reduced initialization count. For compound (huge) pages under vmemmap optimization, only head and first-tail struct pages are fully initialized; the remaining tail struct pages are considered redundant and are skipped. In the early-section reuse path, those tail pages are real and writable but remain uninitialized, constituting a CWE-class uninitialized resource use (analogous to CWE-908). The bug was introduced at commit 6fd3620b342861de9547ea01d28f664892ef51a1 and affects multiple stable kernel branches. Tags from ENISA EUVD confirm Denial of Service as a primary impact category.