What is the CVSS score of CVE-2026-80671?

CVE-2026-80671 has a contested CVSS base score of 9.3 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2026-80671?

Within 24 hours, identify all systems running the perf tool from linux-tools and determine which teams use it to analyze external or untrusted performance data. Within 7 days, apply the CVE-2026-80671 patch to all affected systems, prioritizing development and infrastructure analysis teams. Within 30 days, establish security controls to restrict perf sched analysis to trusted, internally-generated performance data only.

Linux perf CVE-2026-80671

EUVD-2026-67547 CRITICAL

2026-08-28 Linux

GHSA-98vx-8r93-84hf

Buffer Overflow Linux

Critical

Disputed · 9.3 Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious perf.data with oversized comm/large PID
Delivery

Deliver trace file to analyst
Exploit

Victim runs 'perf sched' on file
Execution

register_pid() integer overflow and strcpy overflow
Impact

Heap corruption / code execution as perf user

Vulnerability Assessment

Exploitation Conditions	Exploitation requires a victim to run the perf 'sched' subcommand (perf sched, e.g. latency/map/replay) against an attacker-controlled perf.data trace file - the crafted file must contain a malicious task/comm record with either a comm string longer than the 20-byte COMM_LEN buffer or a PID large enough to overflow (pid + 1) * sizeof(pointer). The integer-overflow path is specifically reachable on 32-bit systems where the size multiplication wraps; the strcpy and BUG_ON paths affect all platforms. Limiting factors: attack is local (AV:L), requires the victim to voluntarily open the malicious file (effective user interaction not reflected in the UI:N vector), and impact is scoped to the privileges of the user running perf rather than automatic root or kernel compromise.
Impact	The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, 9.3) overstates real-world risk for this class of tool bug. The vector is local (AV:L), which is correct, but it omits the user interaction that exploitation actually requires - a victim must deliberately open a malicious perf.data file with 'perf sched' - so UI:N is questionable and the scope-changed S:C rating is generous for corruption confined to the perf process. Corroborating signals point to low urgency: EPSS is 0.18% (8th percentile), the CVE is not on CISA KEV (not actively exploited), and no public exploit is identified. This is a defense-in-depth hardening fix for parsing untrusted trace data rather than a widely exploitable remote flaw; prioritize it for multi-user systems and CI/forensic pipelines that ingest externally sourced perf.data, but it is not an emergency patch for typical single-operator use where perf only reads self-generated traces.
Exploit ScenarioDerived	An attacker crafts a malicious perf.data file with an oversized comm field or a very large PID (e.g. 0x40000000) and delivers it to a victim - for example as a bug-report attachment or shared profiling trace. When the victim runs 'perf sched latency' or 'perf sched map' on the file, register_pid() performs an undersized realloc and out-of-bounds heap writes plus an unchecked strcpy, corrupting memory and potentially executing code as the analyzing user. No public proof-of-concept has been identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Heap and integer-overflow memory corruption in the Linux kernel's userspace perf tool (perf sched) lets a malicious perf.data file corrupt memory when parsed by register_pid(). An analyst who runs 'perf sched' against an attacker-supplied perf.data trace can trigger out-of-bounds heap writes, an unchecked strcpy into a 20-byte comm buffer, and denial of service, potentially leading to code execution in the context of the user running perf. A vendor fix is available; EPSS is low (0.18%) and there is no public exploit identified at time of analysis.

RemediationAI

Upgrade the perf tools (linux-tools / kernel-tools package) to a build containing the fix - stable kernel series 6.18.40, 7.1.5, or 7.2 or later per EUVD, corresponding to upstream commits 5949d339f5ec, 652cea73b7b7, and 5ea1dcc9418c (https://git.kernel.org/stable/c/652cea73b7b7b7c622a2be670e44e3c499c6d49f). Distribution users should apply the vendor's updated linux-tools package. Until patched, the practical compensating control is procedural: do not run 'perf sched' (or other perf report commands) against perf.data files received from untrusted sources, and in shared/CI/forensic environments restrict perf.data ingestion to trusted producers and run analysis under an unprivileged, sandboxed account so any memory corruption is confined; the trade-off is added operational friction in workflows that analyze externally captured traces. There is no meaningful network control to apply since exploitation is local to the file-parsing operation.

Affected VersionsENISA

Linux patch: 7.2

Linux patch: 6.18.40

Linux 2.6.32

Linux patch: 0

Linux patch: 7.1.5

Linux ec156764d424dd67283c2cd5e9f6f1b8388364ac <5949d339f5ec98752d56dcd4e36f619a59d513a5

Linux ec156764d424dd67283c2cd5e9f6f1b8388364ac <652cea73b7b7b7c622a2be670e44e3c499c6d49f

Linux ec156764d424dd67283c2cd5e9f6f1b8388364ac <5ea1dcc9418c4e06ce29ed5170596f497ba86872

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is in the perf userspace profiling utility shipped with the Linux kernel source (tools/perf), not in the running kernel itself, despite the 'In the Linux kernel' advisory prefix. register_pid() parses per-task records from a perf.data capture file and maintains a sched->tasks array indexed by PID. Root-cause classes (CWE is listed N/A, but these map to CWE-190 integer overflow, CWE-122 heap buffer overflow, and CWE-787 out-of-bounds write): (1) the allocation size (pid + 1) * sizeof(struct task_desc *) can wrap on 32-bit systems for large PIDs like 0x40000000, yielding an undersized realloc followed by OOB writes; (2) strcpy(task->comm, comm) copies an untrusted comm string into a fixed 20-byte COMM_LEN buffer with no bounds check; (3) BUG_ON on allocation failure crashes the process on untrusted input; and (4) realloc results assigned directly back leak the old pointer and leave nr_tasks/state corrupted on failure. The fix caps PID at PID_MAX_LIMIT (4194304), replaces strcpy with strlcpy, guards NULL comm, replaces BUG_ON with graceful NULL returns, and adds caller NULL checks.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY 9.3 CRITICAL

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI 7.8 HIGH

Local file parsing requiring the victim to open a malicious perf.data (UI:R); corruption stays within the perf process (S:U) but can yield code execution as the running user (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Aug 29, 2026 - 07:22 NVD

9.3 (CRITICAL)

Patch available

Aug 28, 2026 - 09:02 EUVD

CVE Published

Aug 28, 2026 - 06:49 cve.org

CRITICAL 9.3

CVE Published

Aug 28, 2026 - 06:49 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

register_pid() has several issues when processing untrusted perf.data:

Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap

to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop.

Heap buffer overflow: strcpy(task->comm, comm) copies the

untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check.

BUG_ON on allocation failure: perf.data is untrusted input, so

allocation failures should be handled gracefully rather than killing the process.

Realloc of sched->tasks assigned directly back, leaking the old

pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure.

Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result.

Executive ViewAI

Why It Matters

The Linux kernel's perf sched tool, used by development and systems teams for performance analysis, contains a vulnerability enabling code execution when analyzing untrusted performance data. Teams that process performance traces from external or untrusted sources face potential compromise. Although current exploitation probability is minimal (EPSS 0.2%), a vendor patch is available and should be applied to reduce exposure.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Prevalence

High

perf profiling tool ships with virtually all Linux distributions

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back