CVE-2026-80671

CVE CVE-2026-80671EUVD EUVD-2026-67547Published 2026-08-28T06:49:11.000ZLast changed 2026-08-29T06:21:57.000ZCVSS 9.3

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 7.2; patch: 6.18.40; 2.6.32; patch: 0; patch: 7.1.5; ec156764d424dd67283c2cd5e9f6f1b8388364ac <5949d339f5ec98752d56dcd4e36f619a59d513a5; ec156764d424dd67283c2cd5e9f6f1b8388364ac <652cea73b7b7b7c622a2be670e44e3c499c6d49f; ec156764d424dd67283c2cd5e9f6f1b8388364ac <5ea1dcc9418c4e06ce29ed5170596f497ba86872

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.