CVE-2026-64036

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The css rstat updated() function, exposed as a BPF kfunc, fails to validate the cpu argument provided by the caller before using it for per-cpu rstat lookups. A BPF iter/cgroup program with CAP BPF and CAP PERFMON privileges can pass an invalid cpu value, leading to an array-index-out-of-bounds condition in kernel/cgroup/rstat.c. This occurs because the function does not verify if the provided value refers to a valid possible CPU.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.