---
id: CVE-2026-64036
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cgroup/rstat: validate cpu before css_rstat_cpu() access

  css_rstat_updated() is exposed as a BPF kfunc and accepts a
  caller-provided cpu argument
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cgroup/rstat: validate cpu before css_rstat_cpu() access

  css_rstat_updated() is exposed as a BPF kfunc and accepts a
  caller-provided cpu argument. The function uses cp…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-129
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.1, < 6.18.34'
  - 'linux_kernel >= 6.19, < 7.0.11'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.11
published: '2026-07-19'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T15:34:06.070'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64036'
references:
  - url: 'https://git.kernel.org/stable/c/6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8817005efbdfdf5d4e4814cb5dc52b53d12917d7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fd2bd9fa7700ddf28296486b2598cff2f80cc819'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00173
epssPercentile: 0.06288
ingestedAt: '2026-10-13T16:35:46.700Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cgroup/rstat: validate cpu before css_rstat_cpu() access

css_rstat_updated() is exposed as a BPF kfunc and accepts a
caller-provided cpu argument. The function uses cpu for per-cpu rstat
lookups without checking whether it refers to a valid possible CPU.

A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an
invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==
0x7fffffff triggers:

  UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9
  index 2147483647 is out of range for type 'long unsigned int [64]'
  Call Trace:
    css_rstat_updated
    bpf_iter_run_prog
    cgroup_iter_seq_show
    bpf_seq_read

Add cpu validation to the BPF-facing css_rstat_updated() kfunc and
move the common implementation to __css_rstat_updated() for in-kernel
callers.

## Affected

- `linux_kernel >= 6.1, < 6.18.34`
- `linux_kernel >= 6.19, < 7.0.11`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.11`