Linux Kernel CVE-2026-72181

The vulnerability resides in MIPS-specific scheduler code (mips/sched) within the Linux kernel. When CONFIG_CPUMASK_OFFSTACK is set at compile time, cpumask_var_t becomes a pointer to a dynamically heap-allocated cpumask structure rather than a fixed-size stack array. The flawed code passed sizeof(new_mask) to copy_from_user(), but since new_mask is a pointer in OFFSTACK mode, sizeof() returns the pointer's byte width (4 bytes on 32-bit MIPS, 8 bytes on 64-bit) rather than the actual cpumask buffer size determined by NR_CPUS. This caused copy_from_user() to write user-supplied bytes into the pointer variable itself, redirecting all subsequent dereferences to an attacker-controlled address. A second independent flaw compounded the impact: copy_from_user() was called before alloc_cpumask_var(), meaning the write targeted unallocated or unrelated memory. The fix allocates the mask buffer first, then uses cpumask_size() to correctly size the copy operation and handles variable-length user masks by truncating oversized input or zero-padding undersized input into the allocated buffer. Although no CWE is formally assigned, the root cause class is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) combined with a pre-allocation write pattern analogous to CWE-672.