KernelScan.io

CRITICAL Introduced in 2.6.32

perf RegisterPid Overflow

CVE-2026-80671

CVSS 9.3 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

KernelScan AI7.8HIGH

01

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result.

02

Engine v0.6.0

Risk summary

The perf sched subcommand contains multiple memory safety flaws when parsing untrusted perf.data files, including integer overflow leading to undersized heap allocations, unbounded string copies into fixed-size buffers, and abrupt process termination on allocation failure. Any local user who can run perf sched with a crafted perf.data file can trigger heap corruption or crash the tool.

Affectedtools/perf/builtin-sched.c (perf sched)

Vulnerability analysis

When the perf sched tool processes a perf.data file, its task registration function trusts pid values and command strings from the file without adequate validation. On 32-bit systems, a large pid value can cause an integer overflow in a size calculation, leading to a tiny heap allocation followed by out-of-bounds writes during initialization. Separately, command strings are copied into fixed 20-byte buffers with no length bound, and allocation failures abort the process rather than being handled gracefully. The fix caps pid values to the kernel's maximum allowed pid, replaces the unbounded copy with a length-checked variant, guards against null command strings, and replaces abrupt aborts with error returns using safe realloc patterns that preserve the original pointer on failure. Any local user with access to the perf tool can trigger these bugs by supplying a crafted perf.data file.

03

BranchIntroducedFixed inPatch commit
5.102.6.325.10.270344e59fc4f2c
5.152.6.325.15.22122263d241bad
6.12.6.326.1.1882003918e13f4
6.62.6.326.6.15729639f00bfa4
6.122.6.326.12.110261d2b5f4afa
6.182.6.326.18.40652cea73b7b7
7.12.6.327.1.55ea1dcc9418c
mainline2.6.327.25949d339f5ec
cip/6.122.6.326.12.111-cip32261d2b5f4afa