Linux Kernel CVE-2026-64036

Exploitation requires a local context possessing BOTH CAP_BPF and CAP_PERFMON capabilities, which the attacker uses to load and run a BPF iter/cgroup program that calls the css_rstat_updated() kfunc directly. The concrete trigger is passing an invalid cpu argument (e.g., 0x7fffffff) that is not a valid possible CPU, causing an out-of-bounds per-cpu rstat array access in kernel/cgroup/rstat.c. Limiting factors: it is local-only (no network vector), requires the two elevated BPF/perf capabilities rather than being available to any unprivileged user, and the clearly demonstrated impact is a UBSAN-detected array-index-out-of-bounds (crash/corruption) rather than a proven privilege-escalation exploit; systems that deny CAP_BPF/CAP_PERFMON to untrusted workloads or disable unprivileged BPF are not exploitable by ordinary users.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local, low-complexity, low-privilege issue with high impact to all three of confidentiality, integrity and availability - consistent with in-kernel memory corruption. However, the CVSS PR:L understates the true barrier: the description states exploitation requires BOTH CAP_BPF and CAP_PERFMON, which are privileged capabilities not held by ordinary unprivileged users, so real-world attacker prerequisites are meaningfully higher than a generic PR:L suggests. Supporting signals argue for measured prioritization rather than emergency: EPSS is very low (0.17%, 6th percentile), the CVE is not in CISA KEV, and no public exploit code is identified. The most concrete confirmed effect is an array-index-out-of-bounds detected under UBSAN (i.e., a demonstrated crash/DoS primitive); whether it is reliably escalatable to code execution or privilege escalation is not established in the provided data. Net: a legitimate patch-worthy kernel bug, but low probability of widespread exploitation and gated behind capabilities that typically imply significant existing privilege.

An attacker who has obtained a context with CAP_BPF and CAP_PERFMON (for example, a compromised monitoring agent or an over-privileged container) loads a BPF iter/cgroup program that calls the css_rstat_updated() kfunc with a crafted cpu value such as 0x7fffffff. The out-of-bounds per-cpu access corrupts or crashes kernel memory, yielding at minimum a denial of service and potentially a corruption primitive for further escalation. No public exploit is identified at time of analysis, and low CVSS attack complexity means the trigger itself is trivial once the required capabilities are held.