CVE-2026-80671 Overview
CVE-2026-80671 affects the Linux kernel's perf sched userspace tool. The register_pid() function contains multiple memory safety defects when parsing untrusted perf.data files. The flaws include an integer overflow in realloc size computation, a strcpy-based heap buffer overflow into a fixed 20-byte COMM_LEN buffer, and a BUG_ON triggered by allocation failure. A crafted perf.data file can trigger out-of-bounds writes, memory corruption, and process termination.
Critical Impact
Parsing a malicious perf.data file with perf sched can cause heap corruption and arbitrary out-of-bounds writes, leading to potential local code execution or denial of service.
Affected Products
- Linux kernel perf userspace tooling (perf sched command)
- 32-bit builds are impacted by the (pid + 1) * sizeof(struct task_desc *) integer overflow
- Distributions shipping unpatched perf binaries built from the affected kernel tree
Discovery Timeline
- 2026-08-28 - CVE-2026-80671 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80671
Vulnerability Analysis
The register_pid() function in perf sched tracks task descriptors indexed by process identifier (PID). When processing a perf.data file, the function performs realloc on sched->tasks sized to (pid + 1) * sizeof(struct task_desc *). On 32-bit systems, a PID such as 0x40000000 causes this multiplication to wrap, returning a small buffer. The subsequent initialization loop then writes past the allocated region, corrupting the heap.
A second defect appears in the comm field handling. strcpy(task->comm, comm) copies the attacker-controlled comm string into a fixed 20-byte COMM_LEN buffer without any length check, producing a straightforward heap buffer overflow [CWE-122].
The function also uses BUG_ON on allocation failure. Because perf.data is untrusted input, a crafted file can force allocation failure and terminate the process. Additionally, the realloc return value is assigned directly to sched->tasks, leaking the original pointer on failure, and nr_tasks is incremented before the realloc call, leaving corrupted state on failure.
Root Cause
The root cause is missing input validation on untrusted perf.data fields combined with unsafe C string and allocation patterns. The pid value is not bounded before arithmetic, the comm string length is not checked before strcpy, and allocation failures are treated as fatal assertions rather than recoverable errors.
Attack Vector
An attacker crafts a malicious perf.data file containing an oversized PID and an overlong comm string. When a user or automated pipeline runs perf sched against the file, register_pid() triggers integer overflow, out-of-bounds heap writes, and controlled corruption of adjacent heap objects. Exploitation requires local access to deliver the file and induce parsing.
See the upstream fixes in Kernel Git Commit 5949d33, Kernel Git Commit 5ea1dcc, and Kernel Git Commit 652cea73 for the technical remediation.
Detection Methods for CVE-2026-80671
Indicators of Compromise
- Unexpected perf process crashes or SIGABRT terminations when parsing .data files from untrusted sources
- Presence of perf.data files containing PID values greater than PID_MAX_LIMIT (4194304) or comm fields exceeding 16 bytes
- Heap corruption signatures in perf core dumps referencing register_pid or sched->tasks
Detection Strategies
- Monitor invocations of perf sched that read files from user-writable or shared directories such as /tmp and network mounts
- Inspect perf.data headers with perf report --header-only before processing to flag anomalous PID or comm values
- Alert on perf binary crashes correlated with recent file drops in shared analysis directories
Monitoring Recommendations
- Capture process telemetry for perf execution, including command-line arguments and parent process context
- Log file provenance for perf.data artifacts ingested by CI, observability, or performance analysis workflows
- Track kernel package and linux-tools package versions across the fleet to identify unpatched hosts
How to Mitigate CVE-2026-80671
Immediate Actions Required
- Apply the upstream perf fixes from the referenced kernel git commits or upgrade to a distribution package containing the patch
- Restrict execution of perf sched to trusted perf.data sources until patched
- Remove or quarantine any perf.data files delivered from untrusted users or external systems
Patch Information
The upstream fix caps pid at PID_MAX_LIMIT (4194304), replaces strcpy with strlcpy, adds NULL checks for the comm field, replaces BUG_ON with NULL-return handling using safe realloc patterns, and adds NULL checks in callers that dereference the result. Apply the patches from Kernel Git Commit 5949d33, Kernel Git Commit 5ea1dcc, and Kernel Git Commit 652cea73.
Workarounds
- Run perf sched only against perf.data files generated locally on trusted hosts
- Enforce filesystem access controls that prevent unprivileged users from writing perf.data files consumed by administrators
- Prefer 64-bit builds of perf where feasible to avoid the 32-bit integer overflow path, though the strcpy overflow remains until patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
