---
id: CVE-2026-80670
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

  machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
  al->cpu >= 0 and env->cpu != …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

  machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
  al->cpu >= 0 and env->cpu != …
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
published: '2026-08-28'
updated: '2026-08-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80670'
references:
  - url: 'https://git.kernel.org/stable/c/5484b43a0ec8231c36fba6ead654cb72dbba8b8f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b9e8406651dcc1c19238aad11861a758683525b4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eb266a14c16a93eb4db7b56a452d6be93f8bdcd4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80670.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80670'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2525391'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80670'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80670'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026082848-CVE-2026-80670-bbb7@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00671
epssPercentile: 0.51815
ingestedAt: '2026-08-30T04:47:10.040Z'
vendor: Red Hat
cwe:
  - CWE-1285
scores:
  nvd: 9.1
  vendor: 5.5
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu
against env->nr_cpus_avail.  Since al->cpu comes from the untrusted
perf.data sample, a crafted file with a large CPU index causes an
out-of-bounds heap read.

Use perf_env__get_cpu_topology() which validates both NULL and bounds.
Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t):
without this, values like 65536 silently truncate to 0, bypassing the
accessor's internal check and returning CPU 0's topology.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80670.json)