Linux kernel cgroup/rstat: BPF kfunc accepts an unvalidated CPU index for per-cpu lookups

Impact

css_rstat_updated() is exposed to BPF programs and used a caller-supplied CPU number for per-cpu rstat lookups without checking it against the possible-CPU mask. A BPF iter/cgroup program can pass an out-of-range value and read or write memory past the per-cpu array, which on a non-UBSAN kernel is an out-of-bounds access rather than a clean report. The caller needs CAP_BPF and CAP_PERFMON, so this is a privileged-local issue: it matters where observability agents, profilers or tenant-visible BPF tooling hold those capabilities on shared GPU nodes, and not on a node where no unprivileged party can load BPF. The fix validates the CPU in the BPF-facing wrapper and moves the unchecked implementation to __css_rstat_updated() for in-kernel callers.

Who can reach it

Local user or container able to load a BPF iter/cgroup program with CAP_BPF and CAP_PERFMON. Not reachable without those capabilities; a default unprivileged pod cannot trigger it.

What to do

Update to a stable kernel containing the cgroup/rstat CPU-validation commits and reboot each node. As an interim control, audit which workloads and sidecars are granted CAP_BPF and CAP_PERFMON and drop them where the observability agent does not need them. No fixed mainline release number is given in the record beyond the listed stable commits.

References

Related entries

• Linux kernel nvme-pci: use-after-free when Host Memory Buffer setup fails during device probeCVE-2026-64071 · Linux kernel nvme-pci (Host Memory Buffer teardown)High
• Linux kernel adm1266 hwmon: PDIO scan bound confused with PMBus command code, out-of-bounds read and writeCVE-2026-64084 · Linux kernel hwmon pmbus/adm1266 (GPIO/PDIO get_multiple bound)High
• Linux kernel adm1266 hwmon: device-supplied block length overflows the blackbox NVMEM buffer by 191 bytesCVE-2026-64085 · Linux kernel hwmon pmbus/adm1266 (blackbox NVMEM record read)High
• Linux kernel adm1266 hwmon: PMBus block read buffer one byte short, i2c write and PEC compare overrunCVE-2026-64086 · Linux kernel hwmon pmbus/adm1266 (pmbus_block_xfer read buffer)High
• Linux kernel IOMMU core: unbalanced unmap accounting on the map error path with iommu_debug onCVE-2026-64152 · Linux kernel IOMMU core (iommu_map error path, iommu_debug tracking)High
• Linux kernel fuse: request left unlocked on return from fuse_ref_folio(), allowing a use-after-freeCVE-2026-64266 · Linux kernel FUSE request handling (fuse_ref_folio)High