CVE-2026-64036

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cgroup/rstat: validate cpu before css_rstat_cpu() access<br /> <br /> css_rstat_updated() is exposed as a BPF kfunc and accepts a<br /> caller-provided cpu argument. The function uses cpu for per-cpu rstat<br /> lookups without checking whether it refers to a valid possible CPU.<br /> <br /> A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an<br /> invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==<br /> 0x7fffffff triggers:<br /> <br /> UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9<br /> index 2147483647 is out of range for type &amp;#39;long unsigned int [64]&amp;#39;<br /> Call Trace:<br /> css_rstat_updated<br /> bpf_iter_run_prog<br /> cgroup_iter_seq_show<br /> bpf_seq_read<br /> <br /> Add cpu validation to the BPF-facing css_rstat_updated() kfunc and<br /> move the common implementation to __css_rstat_updated() for in-kernel<br /> callers.