CRITICAL Introduced in 2.6.32
perf RegisterPid Overflow
CVE-2026-80671
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result.
02KernelScan AI Analysis
Risk summary
The perf sched subcommand contains multiple memory safety flaws when parsing untrusted perf.data files, including integer overflow leading to undersized heap allocations, unbounded string copies into fixed-size buffers, and abrupt process termination on allocation failure. Any local user who can run perf sched with a crafted perf.data file can trigger heap corruption or crash the tool.
Vulnerability analysis
When the perf sched tool processes a perf.data file, its task registration function trusts pid values and command strings from the file without adequate validation. On 32-bit systems, a large pid value can cause an integer overflow in a size calculation, leading to a tiny heap allocation followed by out-of-bounds writes during initialization. Separately, command strings are copied into fixed 20-byte buffers with no length bound, and allocation failures abort the process rather than being handled gracefully. The fix caps pid values to the kernel's maximum allowed pid, replaces the unbounded copy with a length-checked variant, guards against null command strings, and replaces abrupt aborts with error returns using safe realloc patterns that preserve the original pointer on failure. Any local user with access to the perf tool can trigger these bugs by supplying a crafted perf.data file.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.32 | 5.10.270 | 344e59fc4f2c |
| 5.15 | 2.6.32 | 5.15.221 | 22263d241bad |
| 6.1 | 2.6.32 | 6.1.188 | 2003918e13f4 |
| 6.12 | 2.6.32 | 6.12.110 | 261d2b5f4afa |
| 6.18 | 2.6.32 | 6.18.40 | 652cea73b7b7 |
| 6.6 | 2.6.32 | 6.6.157 | 29639f00bfa4 |
| 7.1 | 2.6.32 | 7.1.5 | 5ea1dcc9418c |
| mainline | 2.6.32 | 7.2 | 5949d339f5ec |
| cip/5.10 | 2.6.32 | 5.10.271-cip78 | 344e59fc4f2c |
| cip/6.1 | 2.6.32 | 6.1.189-cip61 | 2003918e13f4 |
| cip/6.1-rt | 2.6.32 | 6.1.189-cip61-rt32 | 2003918e13f4 |
| cip/6.12 | 2.6.32 | 6.12.111-cip32 | 261d2b5f4afa |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |