CVE-2026-64477: Linux Kernel Privilege Escalation Flaw

CVE-2026-64477 Overview

CVE-2026-64477 is an out-of-bounds access vulnerability in the Linux kernel's x86,fs/resctrl subsystem. The flaw occurs during CPU offlining when Sub-NUMA Clustering (SNC) is enabled. When a monitoring domain's cpu_mask becomes empty during offline, the limbo handler still reads Resource Monitoring ID (RMID) values. On SNC-enabled systems, this triggers a NUMA node ID lookup via cpu_to_node() using nr_cpu_ids as an argument, producing an out-of-bounds access [CWE-125].

Critical Impact
Out-of-bounds memory access in the kernel's resctrl filesystem handler during CPU offline operations on systems with SNC enabled, potentially leading to kernel instability.

Affected Products

Linux kernel versions containing the affected fs/resctrl monitoring domain offline logic
x86 systems with Sub-NUMA Clustering (SNC) enabled
Systems using Last Level Cache (LLC) occupancy monitoring via resctrl

Discovery Timeline

2026-07-25 - CVE-2026-64477 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64477

Vulnerability Analysis

The Linux kernel's resctrl (Resource Control) filesystem manages CPU cache and memory bandwidth allocation. When Sub-NUMA Clustering is enabled, a logical RMID must be translated to a physical RMID before hardware event counters can be read. This translation depends on the NUMA node ID of the monitoring domain.

The architecture tracks online CPUs associated with each domain via a cpu_mask in the domain header. When that mask becomes empty, the kernel initiates domain offline and calls into resctrl to release the domain. For monitoring domains tracking LLC occupancy, the limbo handler is forced to clear all busy RMID state.

The limbo handler reads the current event value for every busy RMID, even when the RMID will be force-released. On SNC systems, this triggers cpu_to_node() on the empty cpu_mask, returning nr_cpu_ids and producing an out-of-bounds array access.

Root Cause

The root cause is missing state validation in the limbo handler. The handler unconditionally reads RMID event counters without checking whether the domain is transitioning offline. Because the RMID-to-physical translation queries the NUMA node of a CPU in cpu_mask, an empty mask returns nr_cpu_ids. This value is then used as an index into per-CPU or per-node data structures.

Attack Vector

Triggering the condition requires local access to a Linux system with SNC enabled and resctrl-based LLC occupancy monitoring configured. An unprivileged operation such as CPU hotplug activity during monitoring domain teardown can surface the flaw. The vulnerability is a reliability and kernel memory safety issue rather than a documented remote exploitation vector.

The upstream fix refactors the limbo handler to skip reading the RMID when the RMID will be forced clean anyway. A safety check was also added to the architecture's RMID reader to guard against similar future scenarios. See the kernel commit for the exact code changes.

Detection Methods for CVE-2026-64477

Indicators of Compromise

Kernel warnings or oops messages referencing cpu_to_node, resctrl, or rdt_mon during CPU offline operations
Unexpected kernel panics on x86 systems with SNC enabled during CPU hotplug events
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads originating from resctrl monitoring code paths

Detection Strategies

Inventory Linux hosts running affected kernel versions with SNC enabled in BIOS or firmware
Correlate kernel log entries (dmesg, journalctl -k) with CPU hotplug operations and resctrl mount points
Audit workloads that dynamically offline CPUs (container orchestrators, power management daemons) on affected hosts

Monitoring Recommendations

Forward kernel logs to a central logging pipeline and alert on resctrl, KASAN, and BUG: entries
Track kernel package versions across the fleet to identify hosts that remain unpatched
Monitor uptime and unplanned reboots on SNC-enabled servers as a proxy for stability regressions

How to Mitigate CVE-2026-64477

Immediate Actions Required

Apply the patched Linux kernel from your distribution vendor once available
Identify all x86 hosts with SNC enabled and prioritize them for patching
Restrict CPU hotplug operations on affected systems until the kernel is updated

Patch Information

The fix is available in upstream Linux kernel commits 58c5ec23b1a2, be1567992417, ebc300b7ee0c, and fc16126cc11d. The patch refactors the limbo handler to skip RMID reads when the RMID will be force-cleared and adds a defensive check inside the architecture's RMID reader.

Workarounds

Disable Sub-NUMA Clustering in BIOS or firmware on affected servers if operationally acceptable
Avoid unmounting the resctrl filesystem or reconfiguring LLC occupancy monitoring during CPU hotplug windows
Pin workloads to prevent CPU offlining on hosts that require SNC and resctrl monitoring simultaneously

bash

# Check whether resctrl is mounted and LLC occupancy monitoring is enabled
mount | grep resctrl
cat /sys/fs/resctrl/info/L3_MON/mon_features

# Verify current kernel version to determine patch status
uname -r