---
id: CVE-2026-72010
title: 'cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed

  Creating a child cpuset where cpuset.mems is never set leads to a div/0
  when a VMA mempolicy wit…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 <
    b7adeba2a21c98c7b20f18e27e3ead86bdb5e08d
  - >-
    Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 <
    fcc8c310539c3cc523419113b227161a96b50550
  - >-
    Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 <
    4b06449384b9ee5b3372bab60601ba5cd4162086
  - >-
    Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 <
    02f67c4f88be8e3dbd91951d13cdcc5bcc82e9c7
  - >-
    Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 <
    fc680afc510157f6b137956011c09abc23eb0842
  - >-
    Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 <
    c844b7d9a9586de15dd28c06da5cc7f6ab28787d
  - >-
    Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 <
    c17f06d8a085d6be58b544a440ce243f5e441a60
  - >-
    Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 <
    b983c56426383e4a06fa5970c4e33cee879b1482
  - Linux 3.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:50:22.064855Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:18.130Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72010'
references:
  - url: 'https://git.kernel.org/stable/c/b7adeba2a21c98c7b20f18e27e3ead86bdb5e08d'
  - url: 'https://git.kernel.org/stable/c/fcc8c310539c3cc523419113b227161a96b50550'
  - url: 'https://git.kernel.org/stable/c/4b06449384b9ee5b3372bab60601ba5cd4162086'
  - url: 'https://git.kernel.org/stable/c/02f67c4f88be8e3dbd91951d13cdcc5bcc82e9c7'
  - url: 'https://git.kernel.org/stable/c/fc680afc510157f6b137956011c09abc23eb0842'
  - url: 'https://git.kernel.org/stable/c/c844b7d9a9586de15dd28c06da5cc7f6ab28787d'
  - url: 'https://git.kernel.org/stable/c/c17f06d8a085d6be58b544a440ce243f5e441a60'
  - url: 'https://git.kernel.org/stable/c/b983c56426383e4a06fa5970c4e33cee879b1482'
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.12553
ingestedAt: '2026-11-06T18:00:12.600Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed

Creating a child cpuset where cpuset.mems is never set leads to a div/0
when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a
CPU hotplug event.

Reproduction steps:
 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems)
 2) Move the task into the child cpuset
 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES
 4) unplug and hotplug a cpu
      echo 0 > /sys/devices/system/cpu/cpu1/online
      echo 1 > /sys/devices/system/cpu/cpu1/online
 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the
    call to __nodes_fold()

The cpuset code passes (cs->mems_allowed) which is not guaranteed to have
nodes to the rebind routine.  Use cs->effective_mems instead, which is
guaranteed to have a non-empty nodemask once we reach that code path.

[ david: add a comment, slightly rephrase description ]

## Affected

- `Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 < b7adeba2a21c98c7b20f18e27e3ead86bdb5e08d`
- `Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 < fcc8c310539c3cc523419113b227161a96b50550`
- `Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 < 4b06449384b9ee5b3372bab60601ba5cd4162086`
- `Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 < 02f67c4f88be8e3dbd91951d13cdcc5bcc82e9c7`
- `Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 < fc680afc510157f6b137956011c09abc23eb0842`
- `Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 < c844b7d9a9586de15dd28c06da5cc7f6ab28787d`
- `Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 < c17f06d8a085d6be58b544a440ce243f5e441a60`
- `Linux >= ae1c802382f7af60aa54879fb4f5920a9df1ff48 < b983c56426383e4a06fa5970c4e33cee879b1482`
- `Linux 3.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.