CVE-2026-64036Patch(linux / linux_kernel)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch linux linux_kernel systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu == 0x7fffffff triggers: UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9 index 2147483647 is out of range for type 'long unsigned int [64]' Call Trace: css_rstat_updated bpf_iter_run_prog cgroup_iter_seq_show bpf_seq_read Add cpu validation to the BPF-facing css_rstat_updated() kfunc and move the common implementation to __css_rstat_updated() for in-kernel callers.

linux CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-129CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

linux_kernel

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Peaked 1d ago at 1 mentions (2026-07-21); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

linux

Products

linux_kernel

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Patch

2100.0%

Referenced assets1 URL

By indicator

https://windowsforum.com/threads/cve-2026-64036-fix-linux-ebpf-kernel-out-of-bounds-flaw.439788/?utm_source=x&utm_medium=social&utm_campaign=news_node84

Full discourse2 posts

DFIR Lab@DFIR_Lab88d
Patch
🚨 HIGH: CVE-2026-64036 (CVSS 7.8) Linux kernel vulnerability allows local privilege escalation via BPF kfunc. Array index out-of-bounds in cgroup/rstat. Affected: Linux kernel Impact: Code execution Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/5aT6NXipCe
Post summary
The tweet alerts users to a high‑severity Linux kernel CVE (CVE‑2026‑64036) that allows local privilege escalation, providing technical details and urging immediate patching.
0000041
94 followersView on X
Windows Forum@windowsforum91d
Patch
🐧 Linux’s eBPF superpower just found another sharp edge: CVE-2026-64036 lets privileged BPF programs trigger an out-of-bounds access. Patch it—programmable kernels need guardrails. https://windowsforum.com/threads/cve-2026-64036-fix-linux-ebpf-kernel-out-of-bounds-flaw.439788/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #LinuxKernel #CveVulnerabilities #EbpfSecurity #Wsl2Security https://t.co/1gLOq3tkMq
Post summary
The post announces CVE‑2026‑64036, an out‑of‑bounds flaw in Linux eBPF, and stresses the need for patching kernels to address the issue.
0000054
1.3K followersView on X

CPE platform detail5 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

5 of 5 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	linux	linux_kernel	-	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-

Explore more

Back to dashboard linux CVEs linux_kernel vulnerabilities