Vulnerability-Lookup

CVE-2026-64477 (GCVE-0-2026-64477)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:51 – Updated: 2026-07-25 08:51

Title

x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled

Summary

In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpu_mask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty the architecture initiates offline of the domain that includes calling on resctrl fs to offline the domain. If it is a monitoring domain in which LLC occupancy is tracked resctrl fs forces the limbo handler to clear all busy RMID state associated with the domain. The limbo handler always reads the current event value associated with a busy RMID irrespective of it being checked as part of regular "is it still busy" check or whether it will be forced released anyway. When reading an RMID on a system with SNC enabled the "logical RMID" is converted to the "physical RMID" and this conversion requires the NUMA node ID of the resctrl monitoring domain that is in turn determined by querying the NUMA node ID of any CPU belonging to the monitoring domain. When the monitoring domain is going offline its cpu_mask is empty causing the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as argument resulting in an out-of-bounds access. Refactor the limbo handler to skip reading the RMID when the RMID will just be forced to no longer be dirty in the domain anyway. Add a safety check to the architecture's RMID reader to protect against this scenario.

Severity

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/ebc300b7ee0c669fa…
https://git.kernel.org/stable/c/be1567992417dc921…
https://git.kernel.org/stable/c/58c5ec23b1a238eb7…
https://git.kernel.org/stable/c/fc16126cc11d9f507…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e13db55b5a0d447dea63cde772c1078405bbbf96 , < ebc300b7ee0c669fa76a7a8858298ff32e296103 (git) Affected: e13db55b5a0d447dea63cde772c1078405bbbf96 , < be1567992417dc92133e74126de7a6066c825ac9 (git) Affected: e13db55b5a0d447dea63cde772c1078405bbbf96 , < 58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2 (git) Affected: e13db55b5a0d447dea63cde772c1078405bbbf96 , < fc16126cc11d9f507130bf84ab137ee0938c900e (git)
Linux	Linux	Affected: 6.11 Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/resctrl/monitor.c",
            "fs/resctrl/monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ebc300b7ee0c669fa76a7a8858298ff32e296103",
              "status": "affected",
              "version": "e13db55b5a0d447dea63cde772c1078405bbbf96",
              "versionType": "git"
            },
            {
              "lessThan": "be1567992417dc92133e74126de7a6066c825ac9",
              "status": "affected",
              "version": "e13db55b5a0d447dea63cde772c1078405bbbf96",
              "versionType": "git"
            },
            {
              "lessThan": "58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2",
              "status": "affected",
              "version": "e13db55b5a0d447dea63cde772c1078405bbbf96",
              "versionType": "git"
            },
            {
              "lessThan": "fc16126cc11d9f507130bf84ab137ee0938c900e",
              "status": "affected",
              "version": "e13db55b5a0d447dea63cde772c1078405bbbf96",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/resctrl/monitor.c",
            "fs/resctrl/monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled\n\nThe architecture updates the cpu_mask in a domain\u0027s header to track which\nonline CPUs are associated with the domain. When this mask becomes empty\nthe architecture initiates offline of the domain that includes calling\non resctrl fs to offline the domain. If it is a monitoring domain in\nwhich LLC occupancy is tracked resctrl fs forces the limbo handler to\nclear all busy RMID state associated with the domain.\n\nThe limbo handler always reads the current event value associated with a\nbusy RMID irrespective of it being checked as part of regular \"is it still\nbusy\" check or whether it will be forced released anyway. When reading an\nRMID on a system with SNC enabled the \"logical RMID\" is converted to the\n\"physical RMID\" and this conversion requires the NUMA node ID of the\nresctrl monitoring domain that is in turn determined by querying the NUMA\nnode ID of any CPU belonging to the monitoring domain.\n\nWhen the monitoring domain is going offline its cpu_mask is empty causing\nthe NUMA node ID query via cpu_to_node() to be done with \"nr_cpu_ids\" as\nargument resulting in an out-of-bounds access.\n\nRefactor the limbo handler to skip reading the RMID when the RMID will\njust be forced to no longer be dirty in the domain anyway. Add a safety\ncheck to the architecture\u0027s RMID reader to protect against this scenario."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-25T08:51:39.558Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ebc300b7ee0c669fa76a7a8858298ff32e296103"
        },
        {
          "url": "https://git.kernel.org/stable/c/be1567992417dc92133e74126de7a6066c825ac9"
        },
        {
          "url": "https://git.kernel.org/stable/c/58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc16126cc11d9f507130bf84ab137ee0938c900e"
        }
      ],
      "title": "x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64477",
    "datePublished": "2026-07-25T08:51:39.558Z",
    "dateReserved": "2026-07-19T15:36:31.791Z",
    "dateUpdated": "2026-07-25T08:51:39.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64477",
      "date": "2026-07-25",
      "epss": "0.00209",
      "percentile": "0.11177"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64477\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:33.243\",\"lastModified\":\"2026-07-25T10:17:33.243\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled\\n\\nThe architecture updates the cpu_mask in a domain\u0027s header to track which\\nonline CPUs are associated with the domain. When this mask becomes empty\\nthe architecture initiates offline of the domain that includes calling\\non resctrl fs to offline the domain. If it is a monitoring domain in\\nwhich LLC occupancy is tracked resctrl fs forces the limbo handler to\\nclear all busy RMID state associated with the domain.\\n\\nThe limbo handler always reads the current event value associated with a\\nbusy RMID irrespective of it being checked as part of regular \\\"is it still\\nbusy\\\" check or whether it will be forced released anyway. When reading an\\nRMID on a system with SNC enabled the \\\"logical RMID\\\" is converted to the\\n\\\"physical RMID\\\" and this conversion requires the NUMA node ID of the\\nresctrl monitoring domain that is in turn determined by querying the NUMA\\nnode ID of any CPU belonging to the monitoring domain.\\n\\nWhen the monitoring domain is going offline its cpu_mask is empty causing\\nthe NUMA node ID query via cpu_to_node() to be done with \\\"nr_cpu_ids\\\" as\\nargument resulting in an out-of-bounds access.\\n\\nRefactor the limbo handler to skip reading the RMID when the RMID will\\njust be forced to no longer be dirty in the domain anyway. Add a safety\\ncheck to the architecture\u0027s RMID reader to protect against this scenario.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/x86/kernel/cpu/resctrl/monitor.c\",\"fs/resctrl/monitor.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e13db55b5a0d447dea63cde772c1078405bbbf96\",\"lessThan\":\"ebc300b7ee0c669fa76a7a8858298ff32e296103\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e13db55b5a0d447dea63cde772c1078405bbbf96\",\"lessThan\":\"be1567992417dc92133e74126de7a6066c825ac9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e13db55b5a0d447dea63cde772c1078405bbbf96\",\"lessThan\":\"58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e13db55b5a0d447dea63cde772c1078405bbbf96\",\"lessThan\":\"fc16126cc11d9f507130bf84ab137ee0938c900e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/x86/kernel/cpu/resctrl/monitor.c\",\"fs/resctrl/monitor.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/be1567992417dc92133e74126de7a6066c825ac9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ebc300b7ee0c669fa76a7a8858298ff32e296103\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fc16126cc11d9f507130bf84ab137ee0938c900e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-25T15:58:36Z",
      "cve": "CVE-2026-64477",
      "id": "CVE-2026-64477",
      "initial_release_date": "2026-07-25T15:58:36Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64477",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64477.json",
      "version": "2"
    }
  }
}

GHSA-72F8-7M2R-7R88

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31

Details

In the Linux kernel, the following vulnerability has been resolved:

x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled

The architecture updates the cpu_mask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty the architecture initiates offline of the domain that includes calling on resctrl fs to offline the domain. If it is a monitoring domain in which LLC occupancy is tracked resctrl fs forces the limbo handler to clear all busy RMID state associated with the domain.

The limbo handler always reads the current event value associated with a busy RMID irrespective of it being checked as part of regular "is it still busy" check or whether it will be forced released anyway. When reading an RMID on a system with SNC enabled the "logical RMID" is converted to the "physical RMID" and this conversion requires the NUMA node ID of the resctrl monitoring domain that is in turn determined by querying the NUMA node ID of any CPU belonging to the monitoring domain.

When the monitoring domain is going offline its cpu_mask is empty causing the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as argument resulting in an out-of-bounds access.

Refactor the limbo handler to skip reading the RMID when the RMID will just be forced to no longer be dirty in the domain anyway. Add a safety check to the architecture's RMID reader to protect against this scenario.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64477"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:33Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled\n\nThe architecture updates the cpu_mask in a domain\u0027s header to track which\nonline CPUs are associated with the domain. When this mask becomes empty\nthe architecture initiates offline of the domain that includes calling\non resctrl fs to offline the domain. If it is a monitoring domain in\nwhich LLC occupancy is tracked resctrl fs forces the limbo handler to\nclear all busy RMID state associated with the domain.\n\nThe limbo handler always reads the current event value associated with a\nbusy RMID irrespective of it being checked as part of regular \"is it still\nbusy\" check or whether it will be forced released anyway. When reading an\nRMID on a system with SNC enabled the \"logical RMID\" is converted to the\n\"physical RMID\" and this conversion requires the NUMA node ID of the\nresctrl monitoring domain that is in turn determined by querying the NUMA\nnode ID of any CPU belonging to the monitoring domain.\n\nWhen the monitoring domain is going offline its cpu_mask is empty causing\nthe NUMA node ID query via cpu_to_node() to be done with \"nr_cpu_ids\" as\nargument resulting in an out-of-bounds access.\n\nRefactor the limbo handler to skip reading the RMID when the RMID will\njust be forced to no longer be dirty in the domain anyway. Add a safety\ncheck to the architecture\u0027s RMID reader to protect against this scenario.",
  "id": "GHSA-72f8-7m2r-7r88",
  "modified": "2026-07-25T12:31:37Z",
  "published": "2026-07-25T12:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64477"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/be1567992417dc92133e74126de7a6066c825ac9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ebc300b7ee0c669fa76a7a8858298ff32e296103"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fc16126cc11d9f507130bf84ab137ee0938c900e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-64477 (GCVE-0-2026-64477)

GHSA-72F8-7M2R-7R88

Tags

Sightings

Nomenclature