CVE-2026-80671

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

register_pid() has several issues when processing untrusted perf.data:

1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap

to a small value on 32-bit systems when pid is large (e.g.

0x40000000), causing realloc to return a tiny buffer followed by

out-of-bounds writes in the initialization loop.

2. Heap buffer overflow: strcpy(task->comm, comm) copies the

untrusted comm string into a fixed 20-byte COMM_LEN buffer with

no length check.

3. BUG_ON on allocation failure: perf.data is untrusted input, so

allocation failures should be handled gracefully rather than

killing the process.

4. Realloc of sched->tasks assigned directly back, leaking the old

pointer on failure; nr_tasks incremented before the realloc,

leaving corrupted state on failure.

Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum

on 64-

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References