CVE-2026-72172

This CVE reveals a contract violation between two memory management functions that accumulated silently over years of kernel optimization. section_activate() correctly detects when it must use the unoptimized boot memmap path for early sections, but compound_nr_pages() assumes vmemmap optimization is always in effect without checking. The result: uninitialized struct pages enter a system where they're among the most heavily referenced structures in the kernel — every buddy allocator split, page migration, compaction pass, and page fault handler touches them. The blast radius isn't bounded by the hotplug path. Poisoned struct pages corrupt buddy allocator metadata silently, manifesting as allocation failures, latency spikes, or unexplained memory pressure — symptoms easily misattributed to hardware or workload issues. Under memory pressure, the kernel operates in degraded states where this corruption reads as "slowness" rather than a crash, making it ideal for low-profile exploitation. The fix — treating early sections as unoptimized when optimization state is uncertain — is defensively sound. But it patches one wound without addressing the underlying pattern: the memory hotplug path has accumulated so many conditional optimization branches that no component owns a shared, authoritative view of the current optimization state. Each function infers it locally, creating silent mismatches that only surface as downstream corruption. Audit your kernel configurations for memory hotplug edge cases, particularly DAX and hotplug-into-unoccupied-subsections scenarios. There is no mechanism to detect the next implicit contract violation before it becomes a CVE — only the symptoms are visible after the fact.

Reviewed through automated stages and approved by a human before publication.