Skip to main content

Linux Kernel EUVDEUVD-2026-45609

| CVE-2026-64036 HIGH
2026-07-19 Linux GHSA-7cqc-fvgj-qm9h
Buffer Overflow Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.6 MEDIUM

Local trigger needing CAP_BPF+CAP_PERFMON justifies PR:H; demonstrated impact is primarily a crash (A:H) with limited proven C/I corruption, so C:L/I:L.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:01 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

cgroup/rstat: validate cpu before css_rstat_cpu() access

css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU.

A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu == 0x7fffffff triggers:

UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9 index 2147483647 is out of range for type 'long unsigned int [64]' Call Trace: css_rstat_updated bpf_iter_run_prog cgroup_iter_seq_show bpf_seq_read

Add cpu validation to the BPF-facing css_rstat_updated() kfunc and move the common implementation to __css_rstat_updated() for in-kernel callers.

AnalysisAI

Local privilege-context memory corruption in the Linux kernel's cgroup/rstat subsystem allows a process holding CAP_BPF and CAP_PERFMON to trigger an out-of-bounds array access by passing an unvalidated CPU index to the css_rstat_updated() BPF kfunc. Because the caller-supplied cpu argument is used for per-cpu rstat lookups without a possible-CPU bounds check, a value such as 0x7fffffff drives an array-index-out-of-bounds condition (confirmed on UBSAN kernels) inside kernel/cgroup/rstat.c. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; exploitation requires elevated BPF-related capabilities, which sharply narrows the realistic attacker set.

Technical ContextAI

The vulnerability lives in the kernel's rstat (recursive statistics) machinery under kernel/cgroup/rstat.c, which aggregates per-cpu cgroup statistics. css_rstat_updated() is exported as a BPF kfunc and takes a caller-provided cpu argument that indexes into a per-cpu array (type 'long unsigned int [64]' in the reported trace). A BPF iter/cgroup program can invoke this kfunc directly; without validating that cpu refers to a valid possible CPU, the index is used raw, producing an out-of-bounds read/write into per-cpu structures. The root cause is a classic missing-bounds-validation on attacker-influenced input (an array-index-out-of-bounds / improper input validation class, effectively CWE-129-style, though the feed lists CWE as N/A and tags it loosely as 'Buffer Overflow'). The fix adds cpu validation to the BPF-facing kfunc and refactors the shared logic into __css_rstat_updated() for trusted in-kernel callers that do not need the check.

RemediationAI

Apply the vendor-released stable kernel update that includes the fix commits (6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6, fd2bd9fa7700ddf28296486b2598cff2f80cc819, and 8817005efbdfdf5d4e4814cb5dc52b53d12917d7), available via the stable tree at https://git.kernel.org/stable/c/6a01413a4e8fcb0263d7bef5075c5f8f4eb3a8b6 and corresponding to fixed builds in the 6.18.34 / 7.0.x / 7.1 line - upgrade to your distribution's kernel package that incorporates these commits and reboot. Where immediate patching is not possible, the most effective compensating control is to restrict who can load BPF programs: withhold CAP_BPF and CAP_PERFMON from untrusted workloads and processes, and/or set kernel.unprivileged_bpf_disabled=1 (sysctl) so that only privileged contexts can reach the vulnerable kfunc - the trade-off is that legitimate monitoring/observability tooling relying on cgroup BPF iterators will lose functionality. Tightening container/pod security profiles (dropping these capabilities in seccomp/capability sets) achieves the same containment for orchestrated environments.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45609 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy