CVE-2026-64036: cgroup/rstat: validate cpu before css_rstat_cpu() access
cgroup/rstat: validate cpu before cssrstatcpu() access
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.0.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.34 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.0.11
Event History
Frequently Asked Questions
Who can trigger this issue?
An attacker needs to run a BPF iter/cgroup program and have both CAP_BPF and CAP_PERFMON. The CVSS vector identifies exploitation as local and requiring low privileges.
What input is used to trigger the out-of-bounds access?
The BPF-facing css_rstat_updated() kfunc accepts a caller-supplied CPU value without validating that it is a valid possible CPU. An invalid CPU value, such as 0x7fffffff, can be used for the per-CPU rstat lookup.
How might an attempted exploit appear on a test kernel?
On an unfixed kernel with UBSAN_BOUNDS enabled, using CPU value 0x7fffffff produces an array-index-out-of-bounds UBSAN report in kernel/cgroup/rstat.c:31:9. The reported call trace includes css_rstat_updated, bpf_iter_run_prog, cgroup_iter_seq_show, and bpf_seq_read.
What does the fix change?
The fix validates the CPU argument in the BPF-facing css_rstat_updated() kfunc before it is used. It also moves the shared implementation to __css_rstat_updated() for in-kernel callers.