CVE-2026-64036 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and ensure they are running a patched kernel to prevent potential array-index-out-of-bounds errors. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the vulnerability's impact on their systems and take necessary actions.

Technical summary

The Linux kernel vulnerability, CVE-2026-64036, is related to the cgroup/rstat module. The css_rstat_updated() function, exposed as a BPF kfunc, did not validate the CPU argument provided by the caller. This allowed a BPF iter/cgroup program with CAP_BPF and CAP_PERFMON to pass an invalid CPU value, potentially triggering an array-index-out-of-bounds error. The vulnerability was resolved by adding CPU validation to the css_rstat_updated() kfunc and moving the common implementation to __css_rstat_updated() for in-kernel callers. The technical details of the vulnerability indicate that it is a critical issue that requires immediate attention from Linux kernel users and administrators.

Defensive priority

Medium-High

Recommended defensive actions

• Inventory Linux kernel installations to identify potential exposure
• Verify kernel patches are applied and up-to-date
• Monitor system logs for array-index-out-of-bounds errors
• Restrict BPF iter/cgroup program execution to authorized users
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-19T16:17:43.847Z and has not been modified since then. The NVD entry is currently Received. The vulnerability was resolved by adding CPU validation to the BPF-facing css_rstat_updated() kfunc. Evidence limits suggest that further details may be required to fully understand the vulnerability. Defenders should verify the patched kernel version and monitor system logs for potential array-index-out-of-bounds errors. The source grounding and evidence limits indicate that the vulnerability's impact is still being assessed, and defenders should exercise caution when evaluating their systems' exposure.

Official resources