CVE-2026-80670

In the Linux kernel, the following vulnerability has been resolved:

perf tools: Use perf_envgetcputopology() in machineresolve()

machine_resolve() accesses env->cpu[al->cpu].socketid after checking

al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu

against env->nrcpusavail.  Since al->cpu comes from the untrusted

perf.data sample, a crafted file with a large CPU index causes an

out-of-bounds heap read.

Use perfenvgetcpu_topology() which validates both NULL and bounds.

Also bounds-check al->cpu before the cast to struct perfcpu (int16t):

without this, values like 65536 silently truncate to 0, bypassing the

accessor's internal check and returning CPU 0's topology.