Description

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr_cpus_avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read. Use perf_env__get_cpu_topology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-28T08:16:52.317Z",
  "pubdate": "2026-08-28T08:16:52.317Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) heap read within the Linux kernel perf subsystem, specifically located in machine__resolve().\nThe flaw arises due to insufficient validation of CPU index values extracted from untrusted perf.data files.\nAn attacker capable of supplying a crafted perf.data file can trigger an out-of-bounds memory access, potentially leading to information disclosure or system crashes (denial of service).\nThe issue affects user-space components of the perf tools responsible for parsing performance data files.\nSuccessful exploitation requires the victim to process a malicious perf.data file, meaning the attack vector is typically localized to the environment where perf tools are executed on hostile input.\nNo specific authentication or network connectivity is required for exploitation; it is triggered during the routine analysis of performance sampling data.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper boundary validation of the al->cpu field within the machine__resolve() function in the perf tools suite.\nIn the vulnerable implementation, the code performs checks for al->cpu >= 0 and whether the env->cpu structure is non-NULL. However, it fails to perform a bounds check against the total number of available CPUs (env->nr_cpus_avail) before accessing the array indexed by al->cpu.\nBecause the perf.data file is treated as untrusted input, an attacker can manipulate the sample metadata to include a CPU index that exceeds the allocated bounds of the env->cpu heap array.\nFurthermore, the vulnerability involves a problematic type cast. The CPU index is cast to an int16_t (struct perf_cpu) before the bounds validation. An attacker can supply a value such as 65536, which, due to truncation during the cast, becomes 0. This bypasses downstream checks and causes the system to erroneously return topology information for CPU 0, leading to logic errors in perf data resolution.\nThe attack flow follows these steps: 1) The attacker constructs a malicious perf.data file with an arbitrarily large or specifically crafted CPU index in the sample metadata. 2) The victim runs the perf tool to analyze or report on this file. 3) machine__resolve() is invoked, processing the untrusted CPU index. 4) The lack of validation against env->nr_cpus_avail results in the pointer arithmetic accessing heap memory outside the intended buffer boundaries.\nThe impact of this OOB read includes the exposure of adjacent heap memory, which could contain sensitive kernel or process information, or triggering a segmentation fault/kernel panic, leading to a denial of service.\nThe vulnerability is resolved by transitioning to perf_env__get_cpu_topology(), which enforces robust boundary checks and handles NULL pointers appropriately, alongside explicit bounds checking of the al->cpu variable prior to any type conversion or indexing operations."
}