CVE-2026-80670

The perf performance-analysis tool in the Linux kernel tree (tools/perf) fails to validate the CPU index from a perf.data sample against env->nr_cpus_avail in machine__resolve(), so a crafted file with an oversized CPU index triggers an out-of-bounds heap read when reading socket topology. A second issue lets CPU values of 65536 or more silently truncate to 0 when cast to int16_t, bypassing the accessor's bounds check and returning CPU 0's topology. An attacker who can get a user or automation to run perf (report/script/annotate) against an attacker-supplied perf.data file can cause disclosure of adjacent heap memory and a crash of the tool, which the 9.1 CVSS score (network vector, high confidentiality and availability impact) reflects. Anyone running the perf tool on Linux systems to analyze perf.data files of unknown or untrusted origin is affected; routine profiling of locally generated files is not an attack vector. Exploitation status: no public proof-of-concept, not in CISA KEV, and EPSS estimates only a 0.5% probability of exploitation in the next 30 days.

What to do: Update the perf / linux-tools package on affected hosts to a build containing the upstream fix (check your distribution's security advisory for the patched package version, as no fixed kernel version is given here). Until patched, avoid running perf report, annotate, or script on perf.data files received from untrusted sources or other machines. No known exploitation exists, so patching can follow normal maintenance cycles, prioritizing systems that regularly ingest third-party trace data.