Linux kernel resctrl: out-of-bounds access when offlining the last CPU of an SNC monitoring domain

CVSS 7.1CVE-2026-64477Kernel, userspace & hypervisorcurated

Impact

On x86 hosts with Sub-NUMA Clustering (SNC) enabled, offlining the last CPU of a resctrl monitoring domain makes the limbo handler read busy RMIDs. The logical-to-physical RMID conversion then calls cpu_to_node() with an empty mask, which is an out-of-bounds access. The realistic result is a kernel crash or memory corruption during CPU hotplug, on hosts that use RDT/resctrl LLC occupancy monitoring, for example for noisy-neighbor control. Hosts without SNC, or that never offline CPUs, do not hit this path.

Who can reach it

Local. It is triggered by offlining CPUs on an SNC-enabled x86 host where resctrl monitoring is active. CPU offline is normally a root or administrative action, though the record scores it as needing low privileges. Tenant containers do not normally have this access.

What to do

Install a kernel that includes the referenced stable fixes and reboot each node, draining GPU workloads first. Until then, avoid offlining CPUs on SNC-enabled hosts that use resctrl monitoring.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-64477 https://git.kernel.org/stable/c/58c5ec23b1a238eb75cb0aba6f69d8f9e68ef0b2 https://git.kernel.org/stable/c/be1567992417dc92133e74126de7a6066c825ac9 https://git.kernel.org/stable/c/ebc300b7ee0c669fa76a7a8858298ff32e296103

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.