CRITICAL Introduced in 4.4
perf MachineResolve OOB
CVE-2026-80670
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr_cpus_avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read. Use perf_env__get_cpu_topology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.
02KernelScan AI Analysis
Risk summary
A crafted perf.data file with a large CPU index triggers an out-of-bounds heap read in the perf tool when resolving samples. An attacker who can get a victim to analyze a malicious perf.data file can leak heap memory contents. The issue is local and is reachable with ordinary user privileges.
Vulnerability analysis
When the perf tool resolves samples from a perf.data file, it reads CPU topology information using a CPU index taken directly from the file without checking it against the number of CPUs actually recorded. A crafted file with an out-of-range CPU index causes the tool to read past the end of the topology array on the heap, leaking memory. Additionally, large values could silently truncate when cast to a narrower integer type, causing incorrect topology lookups. The fix validates the CPU index against the available count before any access and uses a bounds-checking accessor, preventing both the over-read and the truncation bypass. The vulnerable path is reached whenever the perf tool processes a perf.data file, so an attacker who can supply or trick a user into analyzing such a file can trigger the read.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 4.4 | 6.18.40 | b9e8406651dc |
| mainline | 4.4 | 7.2 | 5484b43a0ec8 |
| 7.1 | 4.4 | 7.1.5 | eb266a14c16a |