CVE-2026-64036: In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat_updated() is exposed as

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before css_rstat_cpu() access css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu == 0x7fffffff triggers: UBSAN: array-index-out-of-bounds in kernel/cgroup/rstat.c:31:9 index 2147483647 is out of range for type 'long unsigned int [64]' Call Trace: css_rstat_updated bpf_iter_run_prog cgroup_iter_seq_show bpf_seq_read Add cpu validation to the BPF-facing css_rstat_updated() kfunc and move the common implementation to __css_rstat_updated() for in-kernel callers.

Description from the National Vulnerability Database, published by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

What it means for a small business

Linux is on the computers, phones or browsers your team uses every day. Turn on automatic updates and restart: most of these fixes only take effect after a restart.

How likely is an attack? The Exploit Prediction Scoring System, run by FIRST (the global association of security response teams), puts the odds of this one being exploited in the next 30 days at 0.13%, higher than 2% of CVEs. That’s low, but low isn’t zero, and the odds jump the day someone publishes an exploit. Scored October 31, 2026, updated daily.

Check your own setup

Website check: reads what your site runs from the outside (WordPress version, plugins it can see, old server software) and matches it against this database.
Server check: what your web server says about itself, and whether that version has known flaws.

Sources

Part of the Huttenlocher Technologies vulnerability database, refreshed twice a day from CISA and the NVD. The title, category and plain-language guidance are ours; check the linked record before acting on a detail. This is general guidance, not a review of your systems.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.