CVE-2026-72016

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description On arm64 architecture, a NULL kobject warning occurs in cpuhp smt enable() when booting with maxcpus exceeding the number of present CPUs. This happens because some CPUs are marked as present but have not been registered via register cpu(), leaving per-cpu device objects uninitialized. When cpuhp smt enable() iterates over present CPUs and calls cpu up(), it leads to sysfs create group() being called with a NULL kobject. This issue is linked to how smp prepare cpus() handles ACPI booting, where it marks all enumerated CPUs as present regardless of their status in the Multiple APIC Description Table (MADT), causing inconsistencies in SMT hotplug control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.