In the Linux kernel, the following vulnerability has been resolved:

perf tools: Use perf env get cpu topology() in machine resolve()

machine resolve() accesses env->cpu[al->cpu].socket id after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nr cpus avail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read.

Use perf env get cpu topology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perf cpu (int16 t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.