The Linux kernel vulnerability CVE-2026-72016 affects arm64 architectures when booting with a maxcpus parameter greater than the number of physically present CPUs (e.g., QEMU configurations with more maxcpus than CPUs). This causes CPUs to be marked as present without being registered, resulting in uninitialized per-CPU device objects. When cpuhp_smt_enable() iterates over these CPUs and calls _cpu_up(), sysfs_create_group() is invoked with a NULL kobject, triggering kernel warnings. The root cause is that ACPI SMP initialization sets all enumerated CPUs as present regardless of their MADT status, causing SMT hotplug control issues. The fix involves checking the ACPI_MADT_ENABLED flag before marking CPUs present, properly managing the present mask during CPU mapping/unmapping, and updating documentation to reflect the corrected behavior.

This vulnerability causes kernel warnings due to NULL kobject dereferences during CPU hotplug operations on arm64 systems booted with certain maxcpus configurations. While no direct exploit or code execution is reported, the issue can lead to system instability or unexpected behavior in CPU hotplug and SMT control logic. It affects kernel reliability and correctness in managing CPU states but does not indicate privilege escalation or data compromise.

A fix has been implemented in the Linux kernel to address this issue by properly managing the present CPU mask and checking ACPI flags during SMP initialization on arm64. Users should update to the fixed kernel version once available. Patch status is not explicitly provided in the input; therefore, check the official Linux kernel vendor advisories or distribution security updates for the relevant patch. No additional mitigation is required beyond applying the official fix.