CVE-2026-64036

A flaw was found in the Linux kernel. A local attacker with specific system privileges could exploit a vulnerability in the cgroup/rstat component. By manipulating a function that processes CPU (Central Processing Unit) statistics, an attacker could cause an out-of-bounds write. This could lead to a system crash, resulting in a denial of service.

This vulnerability is rated as Moderate because successful exploitation requires local execution with elevated privileges, specifically CAP_BPF and CAP_PERFMON, to load and run specialized BPF iterator programs. While an invalid CPU identifier passed to the cgroup statistics BPF helper can cause an out-of-bounds memory access leading to a kernel crash and denial of service, unprivileged users cannot trigger the condition in standard Red Hat Enterprise Linux environments. Because standard configurations do not grant unprivileged accounts the necessary capabilities to attach these BPF programs, the practical security exposure is constrained to already-privileged local operators.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.