External risk intelligence

Linux Kernel Perf Heap Read Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-80670

The vulnerability exists within the Linux kernel's perf tooling during the processing of perf.data files. This is a local analysis tool used for performance profiling and debugging, not a network-facing service or daemon. It requires a user to manually process a crafted data file, making it highly unlikely to be exposed to or reachable from the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Linux kernel's performance analysis tools could allow an attacker to read sensitive system information by providing a specially crafted data file. This issue has been resolved.

Unchecked CPU index in performance data reads.
Potential for unauthorized data access.
Confirm relevance and exposure of the affected tool.

Attack Path

How an attacker could exploit the issue

An attacker can trigger this vulnerability by providing a specially crafted `perf.data` file to the Linux kernel's performance analysis tools. The vulnerability lies in how the `machine__resolve()` function handles CPU topology data from this file, potentially leading to an out-of-bounds read when processing an invalid CPU index.

Entry condition: Malicious `perf.data` file.
Trigger point: Processing CPU topology data.
Resulting risk: Sensitive data disclosure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's perf tools could allow an attacker to read out-of-bounds memory when processing a specially crafted `perf.data` file. This could potentially expose sensitive system information that is present in the read memory.

System memory data.
Crafted `perf.data` file processed locally.
Exposure of sensitive system information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's perf tools requires a crafted `perf.data` file to trigger an out-of-bounds heap read. The first step is to identify all systems running the affected Linux kernel and determine if they process untrusted `perf.data` files. Confirming business criticality and accountable ownership for these systems will inform the remediation plan.

Identify systems processing untrusted perf data.
Verify business criticality and ownership.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel perf tool?

The perf tool is a sophisticated performance monitoring and profiling suite integrated into the Linux kernel. Developers and system administrators use it to collect and analyze CPU statistics, trace events, and hardware performance counters, helping them identify bottlenecks and optimize how applications interact with the underlying system hardware.

What does CVE-2026-80670 mean for data safety?

This vulnerability is an out-of-bounds heap read. It occurs because the tool fails to properly verify CPU index numbers found in profiling data files. If a malicious file provides an unusually large CPU index, the software may read memory outside of its intended boundaries, potentially leaking sensitive information from the system's heap memory.

How is this CVE-2026-80670 vulnerability triggered?

The issue is triggered only when a user actively processes a specially crafted perf.data file using the affected tool. It does not trigger during normal system operation or while simply monitoring live system performance; it requires the manual ingestion of a manipulated data file that contains an invalid or oversized CPU index value.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal classifies this as very unlikely to be exposed via the internet. Because the perf tool is typically a local utility used for diagnostic tasks rather than a network-facing service, an attacker cannot remotely reach it; they would first need a way to deliver and force a user to analyze a malicious file on a local machine.

Do I need to take action if I use the Linux kernel?

Start by identifying which of your systems are used to analyze performance data, particularly if those systems process files from untrusted sources. Evaluate your workflows to see if you frequently import or analyze external perf.data files. Once you confirm these assets, monitor for official distribution updates that incorporate the patched version of the perf tools.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.