CVE-2026-64036: Linux Kernel Privilege Escalation Flaw

CVE-2026-64036 Overview

CVE-2026-64036 is an out-of-bounds array access vulnerability in the Linux kernel's cgroup rstat subsystem. The flaw resides in css_rstat_updated(), a function exposed as a Berkeley Packet Filter (BPF) kfunc that accepts a caller-provided CPU argument. The function performs per-CPU rstat lookups using the supplied index without validating that it corresponds to a possible CPU. A BPF iter/cgroup program running with CAP_BPF and CAP_PERFMON can pass an arbitrary CPU value, triggering an array-index-out-of-bounds condition in kernel/cgroup/rstat.c.

Critical Impact
A local attacker with CAP_BPF and CAP_PERFMON can trigger out-of-bounds memory access in the kernel, potentially leading to memory corruption, information disclosure, or denial of service.

Affected Products

Linux kernel (mainline) cgroup rstat subsystem
Kernel builds exposing css_rstat_updated() as a BPF kfunc
Systems permitting BPF iter/cgroup programs with CAP_BPF and CAP_PERFMON

Discovery Timeline

2026-07-19 - CVE-2026-64036 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64036

Vulnerability Analysis

The vulnerability affects the cgroup rstat (recursive statistics) subsystem, which tracks per-CPU statistics for control groups. The function css_rstat_updated() is registered as a BPF kfunc, allowing BPF programs to invoke it directly. The function dereferences a per-CPU pointer using a caller-supplied cpu index without bounds checking.

The reproduction demonstrates that supplying cpu == 0x7fffffff triggers a UBSAN report on kernels compiled with UBSAN_BOUNDS:

UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9
index 2147483647 is out of range for type 'long unsigned int [64]'
Call Trace:
  css_rstat_updated
  bpf_iter_run_prog
  cgroup_iter_seq_show
  bpf_seq_read

On production kernels without UBSAN, the same access path reads or updates memory outside the intended per-CPU array. The fix adds CPU validation to the BPF-facing wrapper and moves the trusted implementation to an internal __css_rstat_updated() for in-kernel callers.

Root Cause

The root cause is missing input validation on an attacker-controlled index at a security boundary. The BPF kfunc trusted the cpu argument passed from BPF programs without calling cpu_possible() or an equivalent range check before indexing per-CPU data structures.

Attack Vector

Exploitation requires local access and both CAP_BPF and CAP_PERFMON capabilities. An attacker loads a BPF iter/cgroup program that calls css_rstat_updated() with a crafted CPU value. The kernel then performs an out-of-bounds access through the bpf_iter_run_prog → cgroup_iter_seq_show → bpf_seq_read path.

The vulnerability mechanism is described in the upstream patches. See the kernel commit fd2bd9fa7700, commit 8817005efbdf, and commit 6a01413a4e8f for the technical fix.

Detection Methods for CVE-2026-64036

Indicators of Compromise

UBSAN kernel log entries referencing array-index-out-of-bounds in kernel/cgroup/rstat.c
Kernel warnings or oops messages naming css_rstat_updated in the call trace
Unexpected kernel memory read faults originating from bpf_seq_read invocations
Unusual loading of BPF iter/cgroup programs by non-root but privileged processes

Detection Strategies

Audit bpf() syscall usage to identify processes loading iter/cgroup programs with CAP_BPF and CAP_PERFMON
Monitor /sys/kernel/debug/tracing and kernel ring buffer output for UBSAN or KASAN reports involving rstat
Track binaries and containers that acquire CAP_BPF or CAP_PERFMON outside expected observability workloads

Monitoring Recommendations

Enable CONFIG_UBSAN_BOUNDS and CONFIG_KASAN in test and staging kernels to surface exploitation attempts
Forward dmesg and journald kernel logs to a central data lake and alert on rstat-related warnings
Baseline BPF program loads per host and alert on new iter-type programs targeting cgroup subsystems

How to Mitigate CVE-2026-64036

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD advisory to all affected hosts
Restrict CAP_BPF and CAP_PERFMON to trusted service accounts and observability agents only
Set kernel.unprivileged_bpf_disabled=1 where BPF is not required by workloads
Audit container runtime configurations that grant BPF-related capabilities to workloads

Patch Information

The fix adds explicit CPU validation to the BPF-facing css_rstat_updated() kfunc and relocates the trusted implementation to __css_rstat_updated() for in-kernel callers. Apply the patches from commit fd2bd9fa7700, commit 8817005efbdf, and commit 6a01413a4e8f. Rebuild or update to a stable kernel that includes these commits.

Workarounds

Disable unprivileged BPF via sysctl -w kernel.unprivileged_bpf_disabled=1 and persist the setting
Remove CAP_BPF and CAP_PERFMON from container capability sets that do not require kernel tracing
Use seccomp profiles to block bpf() syscall invocation from untrusted processes

bash

# Configuration example: disable unprivileged BPF and audit privileged BPF use
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf

# Add an audit rule for bpf() syscall usage
auditctl -a always,exit -F arch=b64 -S bpf -k bpf_syscall