Linux perf tools EUVD-2026-67546

Exploitation requires the victim to process an attacker-controlled perf.data file with the vulnerable perf tooling - the concrete prerequisite is invoking perf (e.g. perf report/script/annotate) on a crafted capture whose sample contains an al->cpu value exceeding env->nr_cpus_avail (or a value like 65536 that truncates to int16_t). Limiting factors: the attack is local and requires user interaction (the target must obtain and open the malicious file), it is not remotely triggerable despite the AV:N label in the input, and impact is confined to heap information disclosure and a crash of the perf process rather than kernel or system compromise. Default profiling of one's own trusted workloads is unaffected; risk arises only when untrusted perf.data is ingested.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.1) overstates real-world risk and conflicts with the description: this is not a remotely reachable network service bug but a local file-parsing defect requiring a victim to run perf against an attacker-supplied perf.data file - effectively AV:L with user interaction, which I reflect in my independent assessment below. The true impact is information disclosure (heap read) and denial of service (crash) in an analyst/developer tool, not remote code execution. Corroborating signals point to low urgency: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit is identified. This is a genuine bug worth patching in the normal kernel-stable update cadence, but the 9.1 rating is a network-vector artifact rather than evidence of a mass-exploitable, high-priority threat; only environments that routinely ingest untrusted perf.data (shared CI, multi-tenant profiling, incident-response triage of foreign captures) face meaningful exposure.

An attacker crafts a malicious perf.data file with a sample carrying an out-of-range CPU index (e.g. a very large value or one that truncates to 0) and delivers it to a victim - for example by uploading it to a shared analysis system or attaching it to an incident-response request. When the analyst opens the file with perf, machine__resolve() reads past the heap-allocated CPU array, leaking adjacent heap memory into processing or crashing the tool. No public exploit is identified at time of analysis, but the trigger is straightforward for anyone able to hand-edit perf.data structures.