The Linux kernel vulnerability (CVE-2026-72067) concerns the CPU hotplug subsystem's error handling in cpuhp_invoke_callback(). When a callback instance fails, the function unwinds earlier callbacks for the same hotplug state. However, the rollback path reused the return value variable, which could hide the original error by overwriting it with the rollback result. This flaw could cause the system to incorrectly report a failed CPU hotplug transition as successful. The vulnerability has been resolved by keeping the rollback result separate from the original error to maintain correct error propagation.

The vulnerability could lead to inaccurate error reporting during CPU hotplug operations in the Linux kernel. This may affect system stability or debugging by masking failures in CPU hotplug callbacks. There is no indication of direct security compromise such as privilege escalation or code execution from the provided data.

A fix for this vulnerability has been implemented in the Linux kernel to correctly preserve per instance callback errors during CPU hotplug operations. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.