Look up another CVE · open CVE-2026-80671 in the interactive tracker
CVE-2026-80671
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem tools/perf. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80671 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
tools/perf/builtin-sched.c
- What this is
- PERFORMANCE EVENTS SUBSYSTEMMAINTAINERS section matched on tools/perf/ · linux-perf-users@vger.kernel.org · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 9.3 critical
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 4.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- tools/perf
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.32 | 5.10.270 | 344e59fc4f2c |
| 2.6.32 | 5.15.221 | 22263d241bad |
| 2.6.32 | 6.1.188 | 2003918e13f4 |
| 2.6.32 | 6.6.157 | 29639f00bfa4 |
| 2.6.32 | 6.12.110 | 261d2b5f4afa |
| 2.6.32 | 6.18.40 | 652cea73b7b7 |
| 2.6.32 | 7.1.5 | 5ea1dcc9418c |
| 2.6.32 | 7.2 | 5949d339f5ec |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is in userspace perf's builtin-sched.c reached only when a local user runs perf sched replay or perf sched latency against a crafted perf.data file via perf_session__process_events; it is not triggered by remote network packets, kernel syscalls, or in-kernel sched code.
- AC:LAttack complexity, low
- The attacker fully controls untrusted perf.data sched_switch/sched_wakeup fields (prev_pid, next_pid, prev_comm, next_comm); large PIDs and overlong comm strings deterministically hit the integer-overflow realloc path or strcpy heap overflow without races or victim-specific memory layout.
- PR:NPrivileges required, none
- In the malicious-trace threat model an external party needs no account or privileges on the victim host—they only supply a crafted perf.data file for a developer, support engineer, or CI job to analyze with perf sched replay/latency.
- UI:NUser interaction, none
- Once a trace is submitted to triage or CI, perf sched replay/latency parses perf.data non-interactively through perf_sched__read_events without further per-event operator actions beyond automated invocation of the perf command on the supplied file.
- S:CScope, changed
- Malicious sched metadata embedded in an externally supplied perf.data crosses from the untrusted reporter/artifact domain into the analyst or CI host security authority when perf parses that file, matching the kernel CNA untrusted-artifact model used for crafted filesystem images.
- C:HConfidentiality impact, high
- Integer-overflow-driven out-of-bounds writes into the pid_to_task table and strcpy heap overflow past task_desc.comm[20] corrupt adjacent heap objects and can disclose process memory beyond a few bounded bytes.
- I:HIntegrity impact, high
- Attacker-controlled overflows corrupt task_desc function pointers and heap metadata (including the atoms pointer), providing controllable userspace memory corruption suitable for arbitrary write and code execution in the perf process.
- A:HAvailability impact, high
- Pre-fix BUG_ON paths abort the perf process on allocation failure, and the heap out-of-bounds writes reliably crash or hang perf during register_pid() while parsing malicious perf.data.