CVE-2026-80670 Overview
CVE-2026-80670 is an out-of-bounds heap read vulnerability in the Linux kernel perf tools. The flaw resides in machine__resolve(), which accesses env->cpu[al->cpu].socket_id without validating al->cpu against env->nr_cpus_avail. Because al->cpu originates from an untrusted perf.data sample, a crafted file with a large CPU index triggers an out-of-bounds read. An additional integer truncation issue exists where values such as 65536 silently truncate to 0 when cast to int16_t, bypassing internal bounds checks.
Critical Impact
A crafted perf.data file can cause the perf tool to read out-of-bounds heap memory, leading to information disclosure or process crash when the file is parsed.
Affected Products
- Linux kernel perf tools (upstream)
- Stable kernel branches referenced by commits 5484b43, b9e8406, and eb266a14
- Distributions shipping unpatched perf userspace tooling
Discovery Timeline
- 2026-08-28 - CVE-2026-80670 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80670
Vulnerability Analysis
The machine__resolve() function in the Linux kernel perf tools resolves address location metadata for perf samples. It reads CPU topology data from the env->cpu[] array indexed by al->cpu. The existing checks only verify that al->cpu >= 0 and env->cpu != NULL. They do not verify that al->cpu is less than env->nr_cpus_avail.
Because al->cpu is derived directly from fields inside a perf.data sample, an attacker who controls the file can supply an arbitrarily large index. The resulting dereference reads heap memory beyond the allocated CPU topology array. This yields an out-of-bounds heap read [CWE-125] that can leak adjacent heap contents or crash the parser.
The upstream fix routes access through perf_env__get_cpu_topology(), which validates both NULL and array bounds before dereferencing.
Root Cause
The root cause is missing input validation on attacker-controlled sample data combined with a numeric truncation defect. The al->cpu field is stored as a wider integer type but is later cast to struct perf_cpu, which contains an int16_t. Values such as 65536 truncate to 0, defeating internal bounds checks and returning CPU 0's topology instead of rejecting the input. Both the missing upper-bound check and the unsafe narrowing cast contribute to the flaw.
Attack Vector
Exploitation requires an analyst or automated pipeline to open a malicious perf.data file with the perf toolchain. Typical scenarios include shared performance traces, CI pipelines that parse uploaded perf.data artifacts, and multi-tenant systems where profiling data crosses trust boundaries. Successful exploitation reads uninitialized or adjacent heap memory during sample resolution.
See the upstream fixes in Kernel Git Commit 5484b43, Kernel Git Commit b9e8406, and Kernel Git Commit eb266a14 for the exact source changes.
Detection Methods for CVE-2026-80670
Indicators of Compromise
- Unexpected crashes or SIGSEGV signals from the perf binary during perf report, perf script, or perf annotate operations.
- perf.data files sourced from untrusted origins containing sample records with CPU index fields exceeding the host's nr_cpus_avail.
- AddressSanitizer or KASAN traces flagging out-of-bounds reads inside machine__resolve().
Detection Strategies
- Audit systems and CI runners for the installed perf version and compare against the patched commits 5484b43, b9e8406, and eb266a14.
- Run perf.data samples of unknown provenance through a sanitizer-enabled build of perf in an isolated environment before analysis.
- Alert on process termination events for perf invocations that consume externally supplied trace files.
Monitoring Recommendations
- Log all invocations of perf report, perf script, and related subcommands together with the path and origin of the input file.
- Monitor for perf processes accessing files outside expected directories, especially in shared or multi-tenant environments.
- Track kernel and distribution package updates for perf userspace tooling and correlate with vulnerability advisories.
How to Mitigate CVE-2026-80670
Immediate Actions Required
- Apply the upstream commits 5484b43a0ec8, b9e8406651dc, and eb266a14c16a or upgrade to a distribution kernel package that includes them.
- Do not parse perf.data files received from untrusted sources until the patched perf binary is deployed.
- Restrict perf execution on shared analysis hosts to trusted operators handling vetted trace files.
Patch Information
The fix replaces direct env->cpu[al->cpu] access with perf_env__get_cpu_topology(), which validates both the pointer and array bounds. It also adds an explicit bounds check on al->cpu before the cast to struct perf_cpu to prevent silent int16_t truncation. Patched sources are available in the upstream Linux stable tree at Kernel Git Commit 5484b43, Kernel Git Commit b9e8406, and Kernel Git Commit eb266a14.
Workarounds
- Isolate perf.data parsing to sandboxed hosts or containers with no access to sensitive memory or credentials.
- Reject or quarantine perf.data files from external contributors in automated pipelines until the toolchain is patched.
- Run perf under a restrictive seccomp profile or as an unprivileged user to limit the impact of an out-of-bounds read.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
