CVE-2026-80670
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the perf tool in the Linux kernel, machine__resolve() does not validate the CPU index from untrusted perf.data before accessing env->cpu array, potentially leading to an out-of-bounds heap read. The fix uses perf_env__get_cpu_topology() and adds bounds checking.
Risk Assessment
The vulnerability could allow an attacker to read data beyond allocated memory, potentially leading to information disclosure or crashes in the perf tool.
Recommendation
Update perf tools to a version containing the fix. Avoid processing untrusted perf.data files until the patch is applied.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr_cpus_avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read. Use perf_env__get_cpu_topology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.