CVE-2026-64036

In the Linux kernel, the following vulnerability has been resolved:

cgroup/rstat: validate cpu before css_rstat_cpu() access

css_rstat_updated() is exposed as a BPF kfunc and accepts a

caller-provided cpu argument. The function uses cpu for per-cpu rstat

lookups without checking whether it refers to a valid possible CPU.

A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an

invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu ==

0x7fffffff triggers:

UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9

index 2147483647 is out of range for type 'long unsigned int [64]'

Call Trace:

css_rstat_updated

bpf_iter_run_prog

cgroup_iter_seq_show

bpf_seq_read

Add cpu validation to the BPF-facing css_rstat_updated() kfunc and

move the common implementation to __css_rstat_updated() for in-kernel

callers.