PatchSiren cyber security CVE debrief
CVE-2026-80670 Linux CVE debrief
The Linux kernel vulnerability CVE-2026-80670 allows for an out-of-bounds heap read due to improper validation of CPU index in the perf tools. This issue arises from the machine__resolve() function accessing env->cpu[al->cpu].socket_id without validating al->cpu against env->nr_cpus_avail. The vulnerability can be triggered by a crafted perf.data sample with a large CPU index. To address this, the perf_env__get_cpu_topology() function is used, which validates both NULL and bounds. Additionally, al->cpu is bounds-checked before casting to struct perf_cpu to prevent silent truncation and bypassing internal checks.
- Vendor
- Linux
- Product
- Unknown
- CVSS
- CRITICAL 9.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-28
- Original CVE updated
- 2026-08-29
- Advisory published
- 2026-08-28
- Advisory updated
- 2026-08-29
Who should care
Linux kernel maintainers, perf tool developers, and users of Linux systems with perf tools enabled should be aware of this vulnerability and apply the necessary patches to prevent potential exploitation.
Technical summary
The CVE-2026-80670 vulnerability is caused by the machine__resolve() function in the Linux kernel's perf tools, which does not validate the CPU index (al->cpu) against the available CPUs (env->nr_cpus_avail). This can lead to an out-of-bounds heap read when processing a crafted perf.data sample with a large CPU index. The issue is addressed by using perf_env__get_cpu_topology(), which validates both NULL and bounds, and by bounds-checking al->cpu before casting to struct perf_cpu.
Defensive priority
High
Recommended defensive actions
- Apply patches provided by the Linux kernel maintainers to update perf tools.
- Restrict access to perf.data samples to trusted sources only.
- Monitor system logs for unusual perf tool behavior.
- Implement compensating controls to detect potential exploitation attempts.
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
Evidence notes
The CVE-2026-80670 vulnerability was identified in the Linux kernel's perf tools. The issue involves a potential out-of-bounds heap read due to inadequate validation of CPU indices derived from untrusted perf.data samples. Official references and source code patches are provided to address this issue.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-80670 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-80670
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-80670 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-80670
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/5484b43a0ec8231c36fba6ead654cb72dbba8b8f
416baaa9-dc9f-4396-8d5f-8c081fb06d67
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/b9e8406651dcc1c19238aad11861a758683525b4
416baaa9-dc9f-4396-8d5f-8c081fb06d67
-
Source reference
Unverified legacy reference
URL: https://git.kernel.org/stable/c/eb266a14c16a93eb4db7b56a452d6be93f8bdcd4
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.