CVE
DEBIAN-CVE-2026-80670
In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() accesses env->cpu[al->cpu].socket_id after c...
In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perfenvgetcputopology() in machineresolve() machineresolve() accesses env->cpu[al->cpu].socketid after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nrcpusavail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read. Use perfenvgetcputopology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perfcpu (int16_t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
-
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
C
H
U
-
Related Resources
No items found.
References
https://security-tracker.debian.org/tracker/CVE-2026-80670