CVE-2026-64036 (GCVE-0-2026-64036)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
cgroup/rstat: validate cpu before css_rstat_cpu() access
Summary
In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu == 0x7fffffff triggers: UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9 index 2147483647 is out of range for type 'long unsigned int [64]' Call Trace: css_rstat_updated bpf_iter_run_prog cgroup_iter_seq_show bpf_seq_read Add cpu validation to the BPF-facing css_rstat_updated() kfunc and move the common implementation to __css_rstat_updated() for in-kernel callers.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a319185be9f5ad13c2a296d448ac52ffe45d194c , < 6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6 (git)
Affected: a319185be9f5ad13c2a296d448ac52ffe45d194c , < fd2bd9fa7700ddf28296486b2598cff2f80cc819 (git)
Affected: a319185be9f5ad13c2a296d448ac52ffe45d194c , < 8817005efbdfdf5d4e4814cb5dc52b53d12917d7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.1
Unaffected: 0 , < 6.1 (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c",
            "include/linux/cgroup.h",
            "kernel/cgroup/rstat.c",
            "mm/memcontrol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6",
              "status": "affected",
              "version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
              "versionType": "git"
            },
            {
              "lessThan": "fd2bd9fa7700ddf28296486b2598cff2f80cc819",
              "status": "affected",
              "version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
              "versionType": "git"
            },
            {
              "lessThan": "8817005efbdfdf5d4e4814cb5dc52b53d12917d7",
              "status": "affected",
              "version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c",
            "include/linux/cgroup.h",
            "kernel/cgroup/rstat.c",
            "mm/memcontrol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/rstat: validate cpu before css_rstat_cpu() access\n\ncss_rstat_updated() is exposed as a BPF kfunc and accepts a\ncaller-provided cpu argument. The function uses cpu for per-cpu rstat\nlookups without checking whether it refers to a valid possible CPU.\n\nA BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an\ninvalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==\n0x7fffffff triggers:\n\n  UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9\n  index 2147483647 is out of range for type \u0027long unsigned int [64]\u0027\n  Call Trace:\n    css_rstat_updated\n    bpf_iter_run_prog\n    cgroup_iter_seq_show\n    bpf_seq_read\n\nAdd cpu validation to the BPF-facing css_rstat_updated() kfunc and\nmove the common implementation to __css_rstat_updated() for in-kernel\ncallers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires loading and running a BPF cgroup iterator/tracing program via local syscalls (bpf, read on iter fd); the call chain is css_rstat_updated \u2192 bpf_iter_run_prog \u2192 cgroup_iter_seq_show \u2192 bpf_seq_read, with no network-facing entry point.\nAC:L - The attacker fully controls the cpu argument passed from BPF (e.g. 0x7fffffff) and can trigger the bug deterministically on each iter read without races or victim-specific state.\nPR:L - Exploitation requires CAP_BPF and CAP_PERFMON to load and run BPF_PROG_TYPE_TRACING/cgroup-iter programs that can invoke the css_rstat_updated kfunc, as stated in the fix commit; these are elevated but not full init-namespace root privileges.\nUI:N - No victim interaction is required; the attacker triggers the bug by loading their own BPF program and reading from the attached iterator file descriptor.\nS:U - The vulnerability corrupts kernel memory from within kernel BPF context on the same host; it does not cross a VM/hypervisor or IOMMU security boundary.\nC:H - An invalid cpu indexes __per_cpu_offset[] out of bounds and yields a wild pointer used for structure reads (llist_on_list), enabling kernel memory disclosure beyond a bounded leak.\nI:H - The same out-of-bounds pointer is written via try_cmpxchg on llist_node.next and llist_add into a per-CPU list head, giving exploitable out-of-bounds kernel memory corruption.\nA:H - Operating on attacker-chosen out-of-bounds kernel addresses can cause kernel oops, panic, or hang during the corrupting cmpxchg/list operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:30.669Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd2bd9fa7700ddf28296486b2598cff2f80cc819"
        },
        {
          "url": "https://git.kernel.org/stable/c/8817005efbdfdf5d4e4814cb5dc52b53d12917d7"
        }
      ],
      "title": "cgroup/rstat: validate cpu before css_rstat_cpu() access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64036",
    "datePublished": "2026-07-19T15:39:24.783Z",
    "dateReserved": "2026-07-19T07:54:57.028Z",
    "dateUpdated": "2026-08-05T12:38:30.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64036",
      "date": "2026-09-21",
      "epss": "0.00127",
      "percentile": "0.02728"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-12T23:58:42.000Z",
      "cve": "CVE-2026-64036",
      "id": "msrc_CVE-2026-64036",
      "initial_release_date": "2026-07-21T01:01:29.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "cgroup/rstat: validate cpu before css_rstat_cpu() access",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64036.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "block/blk-cgroup.c",
                  "include/linux/cgroup.h",
                  "kernel/cgroup/rstat.c",
                  "mm/memcontrol.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6",
                    "status": "affected",
                    "version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd2bd9fa7700ddf28296486b2598cff2f80cc819",
                    "status": "affected",
                    "version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8817005efbdfdf5d4e4814cb5dc52b53d12917d7",
                    "status": "affected",
                    "version": "a319185be9f5ad13c2a296d448ac52ffe45d194c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "block/blk-cgroup.c",
                  "include/linux/cgroup.h",
                  "kernel/cgroup/rstat.c",
                  "mm/memcontrol.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.1"
                  },
                  {
                    "lessThan": "6.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup/rstat: validate cpu before css_rstat_cpu() access\n\ncss_rstat_updated() is exposed as a BPF kfunc and accepts a\ncaller-provided cpu argument. The function uses cpu for per-cpu rstat\nlookups without checking whether it refers to a valid possible CPU.\n\nA BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an\ninvalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==\n0x7fffffff triggers:\n\n  UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9\n  index 2147483647 is out of range for type \u0027long unsigned int [64]\u0027\n  Call Trace:\n    css_rstat_updated\n    bpf_iter_run_prog\n    cgroup_iter_seq_show\n    bpf_seq_read\n\nAdd cpu validation to the BPF-facing css_rstat_updated() kfunc and\nmove the common implementation to __css_rstat_updated() for in-kernel\ncallers."
          }
        ],
        "id": "CVE-2026-64036",
        "lastModified": "2026-07-30T14:59:47.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:43.847",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8817005efbdfdf5d4e4814cb5dc52b53d12917d7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fd2bd9fa7700ddf28296486b2598cff2f80cc819"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T06:22:52+00:00",
      "cve": "CVE-2026-64036",
      "id": "CVE-2026-64036",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cgroup/rstat: validate cpu before css_rstat_cpu() access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64036.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:56:56Z",
      "cve": "CVE-2026-64036",
      "id": "CVE-2026-64036",
      "initial_release_date": "2026-07-21T13:01:00Z",
      "product_status:known_affected": "123",
      "product_status:known_not_affected": "251",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64036",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64036.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.