# cpu: hotplug: Preserve per instance callback errors

CVE record · `CVE-2026-72067`

- **Identifiers:** `CVE-2026-72067`
- **State:** Confirmed
- **Severity:** CVSS 7.8 High
- **Critical:** No
- **CNA:** Linux
- **Weakness (CWE):** [CWE-754](https://cwe.mitre.org/data/definitions/754.html)
- **Tags:** [CWE-754](https://agentprime.io/advisories/tag/cwe-754.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 15 Aug 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 15 Aug 2026, 05:52 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `724a86881d03ee5794148e65142e24ed3621be66 to before fe9c8d641f6991614d1229a3ffd3e33b879bba9c` (git)
  - affected: `724a86881d03ee5794148e65142e24ed3621be66 to before ef39758637cc5b603fb05b625c45a98aa306e338` (git)
  - affected: `724a86881d03ee5794148e65142e24ed3621be66 to before 95232281512b15338549171ed9a2acf21f946ffb` (git)
  - affected: `724a86881d03ee5794148e65142e24ed3621be66 to before 7a68257b90d8a9b6d605abc99469ded45ecba63b` (git)
  - affected: `724a86881d03ee5794148e65142e24ed3621be66 to before 77d4fa8a3ea1c3e8b996ac35e59aee9e77389905` (git)
  - affected: `724a86881d03ee5794148e65142e24ed3621be66 to before f77117530fc3f5932ffb107182a6dd34006be9b6` (git)
  - affected: `724a86881d03ee5794148e65142e24ed3621be66 to before 9f7dc355f62c011e4afe8286cf71130d4bfb9d80` (git)
  - affected: `724a86881d03ee5794148e65142e24ed3621be66 to before 673db10729fb121ea1b16fe57791a0cb9eac1eb5` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.14`
  - unaffected: `before 4.14` (semver)
  - unaffected: `5.10.261 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.212 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.178 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.145 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.97 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.40 to 6.18.*, inclusive` (semver)
  - unaffected: `7.1.5 to 7.1.*, inclusive` (semver)
  - unaffected: `7.2 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0018, the 7th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 15 Aug 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-72067](https://www.cve.org/CVERecord?id=CVE-2026-72067)
- [NVD: CVE-2026-72067](https://nvd.nist.gov/vuln/detail/CVE-2026-72067)

### References from the CNA

- <https://git.kernel.org/stable/c/fe9c8d641f6991614d1229a3ffd3e33b879bba9c>
- <https://git.kernel.org/stable/c/ef39758637cc5b603fb05b625c45a98aa306e338>
- <https://git.kernel.org/stable/c/95232281512b15338549171ed9a2acf21f946ffb>
- <https://git.kernel.org/stable/c/7a68257b90d8a9b6d605abc99469ded45ecba63b>
- <https://git.kernel.org/stable/c/77d4fa8a3ea1c3e8b996ac35e59aee9e77389905>
- <https://git.kernel.org/stable/c/f77117530fc3f5932ffb107182a6dd34006be9b6>
- <https://git.kernel.org/stable/c/9f7dc355f62c011e4afe8286cf71130d4bfb9d80>
- <https://git.kernel.org/stable/c/673db10729fb121ea1b16fe57791a0cb9eac1eb5>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-72067>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-72067/>. Everything for agents: <https://agentprime.io/llms.txt>.