CVE-2026-80670Critical· 9.1▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf_env__get_cpu_topology() in machine__resolve() machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.7%
In the Linux kernel, the following vulnerability has been resolved:
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
machine__resolve() accesses env->cpu[al->cpu].socket_id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr_cpus_avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read.
Use perf_env__get_cpu_topology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-72244High· 7.8In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of try_harder when alignment cannot be honoured The try_harder contiguous fallback could return a range whose start offset did not match the caller…
CVE-2026-59879Medium· 5.3immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations (CVE-2026-59879)
CVE-2026-116174Medium· 5.9vllm: vllm: Denial of Service via invalid prompt token IDs in gRPC service (CVE-2026-116174)
CVE-2026-98856Medium· 4.4kernel: kprobes: Skip disarmed probes when checking optkprobe overlap (CVE-2026-98856)
CVE-2026-98599Medium· 6.7kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() (CVE-2026-98599)
CVE-2026-82333High· 7.5multer: Multer: Denial of Service via oversized array index in field names (CVE-2026-82333)