CVE-2026-80671

Critical

In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result.

Package Linux Kernel
Published 2026-08-28
Last modified 2026-09-14
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

9.3

out of 10
Critical
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected versions

Linux kernel versions 2.6.32 and later are affected. Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.40, 7.1.5, 7.2 and their respective stable series.

Affected from
≥ 2.6.32
Fixed in
✓ 5.10.270 5.10.x ✓ 5.15.221 5.15.x ✓ 6.1.188 6.1.x ✓ 6.6.157 6.6.x ✓ 6.12.110 6.12.x ✓ 6.18.40 6.18.x ✓ 7.1.5 7.1.x ✓ 7.2

References

8 total
Showing 5 of 8 references View all on NVD

Frequently asked questions

  • What is CVE-2026-80671?

    CVE-2026-80671 is a Critical severity Linux kernel vulnerability with a CVSS score of 9.3 out of 10 . It affects Linux kernel versions from 2.6.32 onward and has been patched in 5.10.270, 5.15.221, 6.1.188 and others. CVE-2026-80671 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2026-80671?

    CVE-2026-80671 has a CVSS score of 9.3 out of 10, rated Critical severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H .

  • Is there a patch available for CVE-2026-80671?

    Yes. CVE-2026-80671 has been patched. Fixed versions include 5.10.270, 5.15.221, 6.1.188 and others. If you are running Linux kernel 2.6.32 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-80671 actively exploited?

    No. CVE-2026-80671 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST