Bug 2525391 (CVE-2026-80670)

Summary: CVE-2026-80670 kernel: perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's perf tools. The `machine__resolve()` function, responsible for resolving machine addresses, does not properly validate CPU index values from untrusted `perf.data` samples. A local attacker could provide a specially crafted `perf.data` file with a large CPU index, leading to an out-of-bounds heap read. This could result in information disclosure or a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-28 07:42:37 UTC 
In the Linux kernel, the following vulnerability has been resolved:

perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu
against env->nr_cpus_avail.  Since al->cpu comes from the untrusted
perf.data sample, a crafted file with a large CPU index causes an
out-of-bounds heap read.

Use perf_env__get_cpu_topology() which validates both NULL and bounds.
Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t):
without this, values like 65536 silently truncate to 0, bypassing the
accessor's internal check and returning CPU 0's topology.
Comment 1 gkamathe 2026-08-31 09:30:13 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082848-CVE-2026-80670-bbb7@gregkh/T