The Linux kernel vulnerability CVE-2026-64036 involves the css_rstat_updated() BPF kfunc in the cgroup/rstat subsystem, which accepted a CPU argument without validating whether it referred to a valid possible CPU. This lack of validation allowed a privileged BPF iter/cgroup program (with CAP_BPF and CAP_PERFMON) to pass an invalid CPU value, leading to an out-of-bounds array access detected by UBSAN in kernel/cgroup/rstat.c. The issue was fixed by adding CPU validation in css_rstat_updated() and moving the core logic to __css_rstat_updated() for safer in-kernel calls.

Exploitation of this vulnerability could cause a kernel memory safety error (array index out-of-bounds), potentially leading to kernel crashes or undefined behavior. However, exploitation requires elevated capabilities (CAP_BPF and CAP_PERFMON), limiting the attack surface to privileged or semi-privileged users. There are no known exploits in the wild.

A fix has been implemented in the Linux kernel to validate CPU arguments in css_rstat_updated(). Users and administrators should apply the official kernel updates that include this patch once available. Until then, restricting access to CAP_BPF and CAP_PERFMON capabilities can reduce risk. Patch status is not yet confirmed in this data; check the vendor advisory for current remediation guidance.