---
id: CVE-2026-80670
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

  machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
  al->cpu >= 0 and env->cpu != …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

  machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
  al->cpu >= 0 and env->cpu != …
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
published: '2026-08-28'
updated: '2026-08-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80670'
references:
  - url: 'https://git.kernel.org/stable/c/5484b43a0ec8231c36fba6ead654cb72dbba8b8f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b9e8406651dcc1c19238aad11861a758683525b4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eb266a14c16a93eb4db7b56a452d6be93f8bdcd4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00671
epssPercentile: 0.4992
ingestedAt: '2026-08-30T04:47:10.040Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu
against env->nr_cpus_avail.  Since al->cpu comes from the untrusted
perf.data sample, a crafted file with a large CPU index causes an
out-of-bounds heap read.

Use perf_env__get_cpu_topology() which validates both NULL and bounds.
Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t):
without this, values like 65536 silently truncate to 0, bypassing the
accessor's internal check and returning CPU 0's topology.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.