CVE-2026-64036

Analyzed Analyzed - Analysis Complete

Array Index Out of Bounds in Linux Kernel cgroup/rstat

Publication date: 2026-07-19

Last updated on: 2026-10-16

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu == 0x7fffffff triggers: UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9 index 2147483647 is out of range for type 'long unsigned int [64]' Call Trace: css_rstat_updated bpf_iter_run_prog cgroup_iter_seq_show bpf_seq_read Add cpu validation to the BPF-facing css_rstat_updated() kfunc and move the common implementation to __css_rstat_updated() for in-kernel callers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-18

NVD

CVE-2026-64036

EUVD

EUVD-2026-45609

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.1 (inc) to 6.18.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a function called css_rstat_updated() which is exposed as a BPF kfunc. The function accepts a user-provided CPU argument but does not validate if the CPU is valid before using it for per-cpu rstat lookups. Passing an invalid CPU value, such as 0x7fffffff, can trigger an out-of-bounds array access, leading to a kernel crash or undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level access to detect. It involves a BPF kfunc (css_rstat_updated) that may trigger an out-of-bounds access when an invalid CPU value is passed. Detection would typically involve checking kernel logs for UBSAN warnings or crashes related to array-index-out-of-bounds errors in cgroup/rstat operations.

Impact Analysis

An attacker with CAP_BPF and CAP_PERFMON capabilities could exploit this flaw to cause a kernel crash or execute arbitrary code in the kernel context. This could lead to denial of service, privilege escalation, or compromise of the entire system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue involving out-of-bounds array access in cgroup/rstat due to invalid CPU input validation, which could lead to system instability or crashes. No evidence suggests it impacts data privacy, security controls, or regulatory compliance requirements.

Mitigation Strategies

Apply the latest kernel patches or updates that include the fix for this issue. The vulnerability is resolved by adding CPU validation to the css_rstat_updated() kfunc. Ensure your system is running a kernel version that includes this patch. Monitor kernel logs for any signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-64036. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70