Cloudanix VulnDB

CVE-2026-80670

Critical · 9.1

CVSS

9.1

EPSS

0.7%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux performance tools could let someone read parts of memory or crash the program simply by getting a user to open a specially crafted data file.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds heap read in machine__resolve() triggered by an untrusted perf.data sample containing a CPU index that exceeds env->nr_cpus_avail, bypassing NULL and bounds checks on env->cpu[].

Why it matters to the business

Processing attacker-supplied performance recordings can leak kernel or user memory contents or cause perf tools to crash, disrupting performance analysis, debugging, and monitoring workflows on Linux systems.

How an attack unfolds

An attacker crafts a perf.data file embedding a sample record with an excessively large CPU index. When the victim runs perf tools such as report or script against the file, machine__resolve() performs an unchecked array access, resulting in an out-of-bounds read.

How to fix it

Upgrade to a Linux kernel or perf-tools package containing the commit that replaces direct env->cpu[] access with perf_env__get_cpu_topology() and adds explicit bounds validation before the int16_t cast.

How to confirm the fix worked

Confirm the presence of the upstream patch in machine__resolve(); fuzz perf tooling with perf.data files containing CPU indices at and beyond env->nr_cpus_avail boundaries.

Typical attack path

  1. Generate a malicious perf.data containing a sample with CPU index >= env->nr_cpus_avail or a value that truncates to a valid index after cast
  2. Distribute the file to a target user or system via email, shared storage, or supply-chain artifact
  3. Victim invokes perf tools to inspect the recording
  4. machine__resolve() dereferences an out-of-bounds heap entry, disclosing memory or crashing

How to detect it

Review system logs and perf crash reports for segmentation faults or out-of-bounds accesses during perf.data processing; no reliable post-exploitation artifacts are known.

What your security team should do

  • Apply the patched perf-tools build as soon as it is available in your distribution
  • Restrict processing of perf.data files to trusted sources only
  • Monitor kernel and perf release notes for the fix and schedule rollout within standard patch windows
  • Consider sandboxing or containerizing perf invocations when handling external recordings

The record

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr_cpus_avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read. Use perf_env__get_cpu_topology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.

Affected packages

Ecosystem Package Introduced Fixed