Cloudanix VulnDB

CVE-2026-80671

Critical · 9.3

CVSS

9.3

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a Linux performance tool can let someone who supplies a specially made data file take over the system or crash it.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Memory corruption in register_pid() via integer overflow on 32-bit systems, heap buffer overflow from unchecked strcpy into fixed COMM_LEN buffer, unsafe realloc patterns, and BUG_ON on allocation failure when processing untrusted perf.data files.

Why it matters to the business

Local attackers can achieve arbitrary code execution or kernel crashes on Linux systems by supplying malicious perf.data files to the perf sched command, potentially leading to privilege escalation or denial of service with moderate urgency given low EPSS and lack of known exploitation.

How an attack unfolds

An attacker crafts a perf.data file containing a large PID value or an oversized comm string, then invokes perf sched on the file; the integer overflow or strcpy causes out-of-bounds writes that corrupt heap structures, allowing control of execution flow without requiring special privileges.

How to fix it

Upgrade to a Linux kernel containing the fix that caps PID at PID_MAX_LIMIT, replaces strcpy with strlcpy, removes BUG_ON, and uses safe realloc with proper NULL checks; avoid processing perf.data files from untrusted sources until patched.

How to confirm the fix worked

Confirm kernel version includes the register_pid() fixes, test perf sched against crafted perf.data files that previously triggered overflows, and verify absence of crashes or corruption under load.

Typical attack path

  1. Craft malicious perf.data with large pid or long comm field
  2. Invoke perf sched command on the file as an unprivileged user
  3. Trigger integer or buffer overflow in register_pid()
  4. Achieve memory corruption leading to code execution or crash

How to detect it

Search system and application logs for perf sched segmentation faults, heap corruption messages, or abnormal allocation failures when processing perf.data files; correlate with user activity involving perf commands.

What your security team should do

  • Apply kernel updates addressing perf sched memory safety issues as soon as available
  • Restrict use of perf sched to trusted perf.data inputs only
  • Monitor for perf-related crashes or unexpected memory behavior in logs
  • Review EPSS and exploit maturity trends periodically for changes in risk

The record

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result.

Affected packages

Ecosystem Package Introduced Fixed