---
id: CVE-2026-80671
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

  register_pid() has several issues when processing untrusted perf.data:

  1
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

  register_pid() has several issues when processing untrusted perf.data:

  1. Integer overflow: (pid + 1) * si…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ec156764d424dd67283c2cd5e9f6f1b8388364ac <
    344e59fc4f2cba6dc04ce5e2a77388645d4ca834
  - >-
    Linux >= ec156764d424dd67283c2cd5e9f6f1b8388364ac <
    22263d241bad753217d545f8085b7ead52e2873b
  - >-
    Linux >= ec156764d424dd67283c2cd5e9f6f1b8388364ac <
    2003918e13f43cf6c5698be3cc9aa3657dd676a8
  - >-
    Linux >= ec156764d424dd67283c2cd5e9f6f1b8388364ac <
    29639f00bfa49da7904ba0a499e0da7a0e5d735e
  - >-
    Linux >= ec156764d424dd67283c2cd5e9f6f1b8388364ac <
    261d2b5f4afa0570ca906e553c93811c5abe4590
  - >-
    Linux >= ec156764d424dd67283c2cd5e9f6f1b8388364ac <
    652cea73b7b7b7c622a2be670e44e3c499c6d49f
  - >-
    Linux >= ec156764d424dd67283c2cd5e9f6f1b8388364ac <
    5ea1dcc9418c4e06ce29ed5170596f497ba86872
  - >-
    Linux >= ec156764d424dd67283c2cd5e9f6f1b8388364ac <
    5949d339f5ec98752d56dcd4e36f619a59d513a5
  - Linux 2.6.32
published: '2026-08-28'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T13:18:48.167'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80671'
references:
  - url: 'https://git.kernel.org/stable/c/2003918e13f43cf6c5698be3cc9aa3657dd676a8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/22263d241bad753217d545f8085b7ead52e2873b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/261d2b5f4afa0570ca906e553c93811c5abe4590'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/29639f00bfa49da7904ba0a499e0da7a0e5d735e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/344e59fc4f2cba6dc04ce5e2a77388645d4ca834'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5949d339f5ec98752d56dcd4e36f619a59d513a5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5ea1dcc9418c4e06ce29ed5170596f497ba86872'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/652cea73b7b7b7c622a2be670e44e3c499c6d49f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00158
epssPercentile: 0.05414
ingestedAt: '2026-08-30T04:47:10.082Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

register_pid() has several issues when processing untrusted perf.data:

1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap
   to a small value on 32-bit systems when pid is large (e.g.
   0x40000000), causing realloc to return a tiny buffer followed by
   out-of-bounds writes in the initialization loop.

2. Heap buffer overflow: strcpy(task->comm, comm) copies the
   untrusted comm string into a fixed 20-byte COMM_LEN buffer with
   no length check.

3. BUG_ON on allocation failure: perf.data is untrusted input, so
   allocation failures should be handled gracefully rather than
   killing the process.

4. Realloc of sched->tasks assigned directly back, leaking the old
   pointer on failure; nr_tasks incremented before the realloc,
   leaving corrupted state on failure.

Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum
on 64-bit), replace strcpy with strlcpy, guard against NULL comm,
replace BUG_ON with NULL returns using safe realloc patterns, and
add NULL checks in callers that dereference the result.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.