CVE-2026-80671

CVE-2026-80671 fixes several memory-safety and robustness bugs in the register_pid() function of the Linux kernel's 'perf sched' tool, which parses perf.data files. When perf sched processes an untrusted perf.data file, an integer overflow in (pid + 1) * sizeof(struct task_desc *) can wrap to a tiny allocation on 32-bit systems and cause out-of-bounds writes, and an unchecked strcpy() can overflow a fixed 20-byte comm buffer with an attacker-controlled string; allocation failures also trigger a BUG_ON crash and pointer/state corruption. An attacker who induces a user (or automated tooling) to analyze a crafted perf.data file gains a crash of the perf process, and the heap overflow could potentially lead to code execution in that process's context. Anyone running the perf tool's sched subcommand on perf.data files from untrusted sources is affected; the attack vector is local (AV:L), so remote-only hosts that never process foreign perf.data are not practically exposed. No public proof-of-concept, KEV listing, or known exploitation exists, and EPSS puts 30-day exploitation probability at only about 0.2%.

What to do: Update the perf tool (via your distribution's linux-tools/kernel-tools or equivalent package) to a build containing the upstream register_pid() fix, since fixes are delivered through kernel tooling updates rather than a runtime component. As an interim mitigation, avoid running 'perf sched' or other perf parsing on perf.data files received from untrusted sources, and treat 32-bit perf builds with heightened caution. Check whether your monitoring or profiling pipelines automatically ingest third-party perf.data files.