Linux kernel maintainers have published a high-severity fix for CVE-2026-64036, a flaw in the cgroup rstat subsystem that can be triggered by eBPF programs with elevated privileges. The vulnerability, rated 7.8 under the CVSS v3.1 scale, allows a local attacker to supply an invalid CPU index to the css_rstat_updated() kfunc, causing an out-of-bounds memory access that could lead to system crashes, information leaks, or potential code execution. While it requires local access and specific Linux capabilities, the bug’s presence in modern kernels—including those used by Windows Subsystem for Linux 2—makes it a practical concern for developers, IT admins, and security-conscious home users.

What Actually Happened

The vulnerability lives in the kernel’s cgroup resource-statistics (rstat) accounting path. Control groups, or cgroups, are the kernel’s mechanism for dividing resources among processes—a foundation for containers, systemd services, and Kubernetes. The rstat subsystem efficiently tracks per-CPU accounting data, allowing tools to query resource usage without expensive synchronization.

Since Linux 6.1, the function css_rstat_updated() has been exposed as a BPF kfunc, meaning approved eBPF programs can call it directly. It takes a CPU number as an argument and uses it to index a per-CPU data structure. The flaw: the function never validated that the provided CPU number is a valid possible CPU on the system. A BPF program—loaded with CAP_BPF and CAP_PERFMON capabilities—could pass a wildly out-of-range index, such as 2,147,483,647 (0x7fffffff), which would bypass any internal bounds check and touch memory beyond the allocated array.

On test kernels built with the Undefined Behavior Sanitizer (UBSAN), this triggers a clear “array-index-out-of-bounds” warning. On production kernels without such checks, the out-of-bounds access could corrupt kernel memory, crash the system, or, under carefully crafted conditions, be leveraged for privilege escalation. The fix, committed to the upstream Linux kernel, adds CPU validation at the BPF-facing entry point and moves the core logic into a separate internal function (__css_rstat_updated()) for trusted in-kernel callers. This cleanly separates the untrusted external path from the internal one, ensuring that only valid CPU indices reach the per-CPU lookup.

Who’s Affected

Any system running a Linux kernel from version 6.1 onward prior to the fixes is potentially vulnerable. That includes a vast number of distributions, cloud instances, container hosts, and developer machines. Specific fixed versions are 6.18.34, 7.0.11, and 7.1, with stable backports already landing in maintained branches. However, because enterprise distributions often backport security patches without bumping the upstream kernel version, simply running uname -r isn’t enough—you must verify that your vendor’s kernel package explicitly addresses CVE-2026-64036.

Windows Users and WSL 2

Windows Subsystem for Linux 2 runs a full Microsoft-maintained Linux kernel inside a lightweight VM. If your WSL 2 installation uses an affected kernel version and you grant BPF-related capabilities to processes inside it (for example, while running Docker, Kubernetes, tracing tools, or custom eBPF programs), the vulnerability is reachable. For most home users who only use WSL for development with standard distributions, the risk is lower because they rarely enable the necessary capabilities. Still, any user who experiments with eBPF tooling or runs privileged containers should pay attention.

Enterprise Linux and Container Deployments

Servers running containerized workloads, observability agents, and performance-monitoring tools are a more acute concern. Many commercial eBPF-based products—observability platforms, security sensors, network monitors—run with CAP_BPF and CAP_PERFMON precisely to inspect system behavior. If an attacker compromises such a process or a privileged container, they could use this bug to crash the host node or potentially escalate privileges. In Kubernetes clusters, a DaemonSet with broad capabilities could become a stepping stone to host-level impact.

How We Got Here: The Rise of eBPF and a Missed Validation

eBPF has transformed Linux observability, security, and networking. By allowing verified bytecode to run in kernel context, it enables deep insight without custom kernel modules. But with that power comes a larger attack surface. Every BPF helper and kfunc becomes a new API into the kernel, and each must independently validate its inputs. The verifier ensures program safety (no wild jumps, valid memory accesses), but it cannot reason about semantic correctness—like whether a scalar value is a sensible CPU index.

In this case, css_rstat_updated() was originally written for internal kernel callers that always pass valid CPU numbers. When it was exposed as a kfunc, that implicit assumption was not re-evaluated. The fix is a textbook example of defensive interface design: wrap the external-facing function with an input check that confirms the CPU index is within the range of possible CPUs (cpu_possible_mask), then hand off to the trusted internal implementation.

The vulnerability emerged against the backdrop of broader adoption. Containers, cloud-native applications, and service meshes all lean on cgroups, and eBPF is now a standard part of many monitoring stacks. That intersection—eBPF, cgroups, per-CPU data—is exactly where security researchers look for boundary errors. The 7.8 score reflects the ease of triggering the bug once an attacker has the required capabilities, and the high impact on confidentiality, integrity, and availability if exploited.

What to Do Now

1. Patch Your Kernel

Install the latest kernel update from your distribution that contains the fix for CVE-2026-64036. Check your vendor’s security advisory for the exact package version. For WSL 2 users, this means ensuring both Windows and the WSL kernel are up to date: run wsl --update from PowerShell or Command Prompt, and then update your Linux distribution packages (e.g., sudo apt update && sudo apt upgrade on Ubuntu). After updating, reboot your machine or restart WSL (wsl --shutdown then relaunch) to load the new kernel.

2. Verify the Active Kernel

After a reboot, run uname -r inside your Linux environment. Compare the output with your distribution’s advisory to confirm the running kernel includes the patch. Many enterprise distributions use kernel version strings that do not match the upstream version; look for a changelog entry mentioning CVE-2026-64036 or the specific commit IDs: 6a01413a4e8f, fd2bd9fa7700, or 8817005efbdf.

3. Audit and Reduce Capabilities

If immediate patching isn’t possible, limit the attack surface by auditing who has CAP_BPF and CAP_PERFMON on your systems. Remove these capabilities from services, containers, and user accounts that don’t need them. Tools like capsh --print inside a container or grep Cap /proc/1/status on the host can help.

For Kubernetes, review your pod security policies or security contexts to ensure containers aren’t granted unnecessary capabilities. Look for DaemonSets running observability agents; verify they run with the minimum required privileges.

4. Consider Interim Mitigations

  • Disable unprivileged BPF sysctl: kernel.unprivileged_bpf_disabled = 1 (if it doesn’t break required functionality).
  • Restrict access to BPF system calls using seccomp profiles.
  • Monitor for unexpected BPF program loads with tools like bpftool, falco, or your security platform’s eBPF sensor. Any new program pinned in /sys/fs/bpf or attached to cgroup iterators should be scrutinized.

5. Look Beyond the Desktop

If you manage cloud instances, container nodes, or development servers, ensure your automated patch management tools target kernel updates explicitly. A system that has installed a new kernel package but hasn’t rebooted is still running the vulnerable kernel—this is a common oversight. Use kexec or orchestration tooling to coordinate reboots with minimal downtime.

Outlook

This vulnerability is a reminder that as eBPF integrates deeper into Linux infrastructure, the kernel’s internal trust boundaries must be continuously re-examined. The upstream fix sets a positive precedent: explicitly validate CPU arguments at the BPF interface, and segregate trusted-from-untrusted call paths. Future kfunc additions will likely undergo stricter review for similar scalar-input validation gaps.

For Windows users, the story is straightforward: keep WSL updated, be mindful of what you run as root or with special capabilities, and treat your Linux environment as a real—not sandboxed—system that needs patching discipline. For enterprises, now is the moment to inventory which agents and workloads rely on BPF, reduce capability sprawl, and incorporate kernel CVE monitoring into your operational rhythm. The fix exists and is low-risk; the biggest risk is not applying it.