A high-severity local privilege escalation vulnerability in the Linux kernel cgroup/rstat component allows local attackers to trigger kernel memory corruption.

The flaw exists in the BPF kfunc css_rstat_updated(), which fails to validate the caller-provided CPU argument. A local attacker with specific capabilities (CAP_BPF and CAP_PERFMON) can exploit this to perform out-of-bounds writes.

With a CVSS score of 7.8, this vulnerability poses a significant risk for local privilege escalation. An attacker capable of executing code on the system can leverage this flaw to elevate privileges to the kernel level, resulting in full system compromise, data theft, or persistent denial of service.

Immediate Action: Update the Linux kernel to version 6.18.34, 7.0.11, or later to incorporate the necessary input validation checks.

Proactive Monitoring: Monitor for unauthorized usage of BPF and PERFMON capabilities and audit local user activity for suspicious execution patterns.

Compensating Controls: Restrict access to sensitive capabilities like CAP_BPF and CAP_PERFMON to trusted users only to minimize the local attack surface.

Public Exploit Available: Unknown.

While this is a local attack vector, the ability to achieve kernel-level execution makes it a high-priority security concern. Administrators must prioritize patching kernel instances to prevent local attackers from escalating their privileges and gaining complete control over the operating environment.