CVE-2026-64036
Received Received - Intake

Array Index Out of Bounds in Linux Kernel cgroup/rstat

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu == 0x7fffffff triggers: UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9 index 2147483647 is out of range for type 'long unsigned int [64]' Call Trace: css_rstat_updated bpf_iter_run_prog cgroup_iter_seq_show bpf_seq_read Add cpu validation to the BPF-facing css_rstat_updated() kfunc and move the common implementation to __css_rstat_updated() for in-kernel callers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64036
EUVD
EUVD-2026-45609

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux linux_kernel to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a function called css_rstat_updated() which is exposed as a BPF kfunc. The function accepts a user-provided CPU argument but does not validate if the CPU is valid before using it for per-cpu rstat lookups. Passing an invalid CPU value, such as 0x7fffffff, can trigger an out-of-bounds array access, leading to a kernel crash or undefined behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level access to detect. It involves a BPF kfunc (css_rstat_updated) that may trigger an out-of-bounds access when an invalid CPU value is passed. Detection would typically involve checking kernel logs for UBSAN warnings or crashes related to array-index-out-of-bounds errors in cgroup/rstat operations.

Impact Analysis

An attacker with CAP_BPF and CAP_PERFMON capabilities could exploit this flaw to cause a kernel crash or execute arbitrary code in the kernel context. This could lead to denial of service, privilege escalation, or compromise of the entire system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue involving out-of-bounds array access in cgroup/rstat due to invalid CPU input validation, which could lead to system instability or crashes. No evidence suggests it impacts data privacy, security controls, or regulatory compliance requirements.

Mitigation Strategies

Apply the latest kernel patches or updates that include the fix for this issue. The vulnerability is resolved by adding CPU validation to the css_rstat_updated() kfunc. Ensure your system is running a kernel version that includes this patch. Monitor kernel logs for any signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart