CVE-2026-80670perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr_cpus_avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read. Use perf_env__get_cpu_topology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.
- CVSS
- 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 29, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0c4c4debb0adda4c18c158d95031dc2b9f637869 before b9e8406651dcc1c19238aad11861a758683525b4; from 0c4c4debb0adda4c18c158d95031dc2b9f637869 before eb266a14c16a93eb4db7b56a452d6be93f8bdcd4; from 0c4c4debb0adda4c18c158d95031dc2b9f637869 before 5484b43a0ec8231c36fba6ead654cb72dbba8b8f | CNA record |
References
- https://git.kernel.org/stable/c/b9e8406651dcc1c19238aad11861a758683525b4
- https://git.kernel.org/stable/c/eb266a14c16a93eb4db7b56a452d6be93f8bdcd4
- https://git.kernel.org/stable/c/5484b43a0ec8231c36fba6ead654cb72dbba8b8f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.