CVE-2026-80671

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The register pid() function contains multiple flaws when processing untrusted perf.data. An integer overflow can occur on 32-bit systems when a large pid is used, leading to out-of-bounds writes. Additionally, a heap buffer overflow exists because strcpy() copies an untrusted string into a fixed 20-byte COMM LEN buffer without length validation. The system also improperly uses BUG ON() during allocation failures, which can crash the process, and fails to handle realloc errors correctly, resulting in memory leaks and corrupted state via the nr tasks variable.

Recommendations As a temporary mitigation, restrict the processing of untrusted perf.data files. Update the Linux kernel to a version where register pid() is patched to cap pid at PID MAX LIMIT, replace strcpy() with strlcpy(), and implement safe realloc patterns with proper NULL checks.