CVE-2026-72066

This is a kernel buffer overflow in the CPU hotplug states sysfs interface that any unprivileged local user can trigger by simply reading an attribute. The `states_show()` function uses unbounded `sprintf()` into a fixed PAGE_SIZE buffer — a pattern as old as the kernel itself, but with an unusual blast radius: sysfs is world-readable by design with no capability check between this code and any local user on the system. A non-privileged process can cause kernel memory corruption with a single `cat` command. The consequence ranges from immediate panic to, in favorable conditions, controlled overwrite exploitable for privilege escalation. The fix replaces `sprintf()` with `sysfs_emit_at()`, which prevents overflow but introduces truncation. If a system registers enough hotplug states to fill a PAGE_SIZE buffer (increasingly common in heterogeneous NUMA topologies, real-time partitions, and nested virtualization), administrators receive silently clipped output with no error indication. This hides misconfiguration rather than exposing it — a diagnostics failure that compounds over time as CPU topologies grow more complex. The deeper question is whether the bound was always too tight. PAGE_SIZE is an implicit contract that nobody validates when writing sysfs handlers. The hotplug state count has been accumulating silently as the kernel acquired NUMA support, real-time partitions, and virtualization layers — each added a state without review of whether the buffer contract still held. The fix closes this specific overflow, but every other sysfs `show()` function using `sprintf()` carries the same latent flaw. Your priority as a defender: audit sysfs handlers in your kernel build for identical patterns, not just patch this one instance.

Reviewed through automated stages and approved by a human before publication.