This is a kernel buffer overflow in the CPU hotplug states sysfs interface that any unprivileged local user can trigger by simply reading an attribute. The states_show() function uses unbounded sprintf() into a fixed PAGE_SIZE buffer — a pattern as old as the kernel itself, but with an unusual blast radius: sysfs is world-readable by design with no capability check between this code and any local user on the system. A non-privileged process can cause kernel memory corruption with a single cat command. The consequence ranges from immediate panic to, in favorable conditions, controlled overwrite exploitable for privilege escalation.
The fix replaces sprintf() with sysfs_emit_at(), which prevents overflow but introduces truncation. If a system registers enough hotplug states to fill a PAGE_SIZE buffer (increasingly common in heterogeneous NUMA topologies, real-time partitions, and nested virtualization), administrators receive silently clipped output with no error indication. This hides misconfiguration rather than exposing it — a diagnostics failure that compounds over time as CPU topologies grow more complex.
The deeper question is whether the bound was always too tight. PAGE_SIZE is an implicit contract that nobody validates when writing sysfs handlers. The hotplug state count has been accumulating silently as the kernel acquired NUMA support, real-time partitions, and virtualization layers — each added a state without review of whether the buffer contract still held. The fix closes this specific overflow, but every other sysfs show() function using sprintf() carries the same latent flaw. Your priority as a defender: audit sysfs handlers in your kernel build for identical patterns, not just patch this one instance.