CVE-2026-80670 perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
A crafted perf.data file triggers an out-of-bounds heap read in Linux perf tools, potentially leaking memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80670?
CVE-2026-80670 is a critical memory corruption vulnerability in Linux, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr_cpus_avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read.
Use perf_env__get_cpu_topology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.
Which versions are affected by CVE-2026-80670?
How do I fix CVE-2026-80670?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-80670 being exploited?
There is no known exploitation of CVE-2026-80670 in the wild and no public exploit code.
Sources
Also known as AZL-98087, BELL-CVE-2026-80670, DEBIAN-CVE-2026-80670, GHSA-wc4v-22m8-hj35, UBUNTU-CVE-2026-80670.