CVE-2026-80671

A flaw was found in the Linux kernel's perf sched subsystem. Multiple vulnerabilities exist within the register_pid() function when processing untrusted performance data. These include an integer overflow that can lead to out-of-bounds memory writes and a heap buffer overflow due to improper string handling. Additionally, allocation failures are not handled gracefully, which can result in a denial of service (DoS) by terminating the process. An attacker could potentially exploit these issues to cause memory corruption, leading to arbitrary code execution or system instability.

A MODERATE severity flaw was found in the Linux kernel's perf tool ('perf sched'), triggered when the userspace perf utility processes an untrusted perf.data file. The register_pid() function contains an integer overflow in the task-array size calculation, which can wrap to a small value on 32-bit systems for large pid values and lead to heap out-of-bounds writes, and copies the untrusted task comm string with strcpy() into a fixed 20-byte buffer without a length check, causing a heap buffer overflow. In addition, allocation failures are handled with BUG_ON, terminating the process. A local attacker who supplies a crafted perf.data file to 'perf sched' could exploit these issues to cause memory corruption in the perf process, potentially leading to arbitrary code execution in the context of the user running the tool, or a denial of service through a crash. Red Hat rates this flaw as MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and processing a crafted perf.data file and the impact is confined to the userspace perf tool; this differs from the upstream CVE record's CRITICAL rating, which assumes no privileges and broad confidentiality, integrity, and availability impact. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel, kernel-rt, and kernel-ivos-qualcomm components have been evaluated as NOT AFFECTED because the vulnerable code is not present in these shipped components.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.