CVE-2026-80670: perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
In the Linux kernel, the following vulnerability has been resolved:
perf tools: Use perfenvgetcputopology() in machineresolve()
machineresolve() accesses env->cpu[al->cpu].socketid after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nrcpusavail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read.
Use perfenvgetcputopology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perfcpu (int16t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update perf tools so that machine__resolve() uses perf_env__get_cpu_topology() to validate env->cpu pointer NULL and bounds against env->nr_cpus_avail before accessing env->cpu[al->cpu].socket_id (prevents out-of-bounds heap read and CPU index truncation such as 65536 -> 0).
perf tools (machine__resolve) CPU topology retrieval = perf_env__get_cpu_topology()