perf sched: integer overflow and strcpy overflow parsing untrusted perf.data

Impact

register_pid() in perf sched trusts values from a perf.data file: (pid + 1) * sizeof(struct task_desc *) can wrap on 32-bit systems so realloc returns a tiny buffer that the init loop then writes past, and strcpy() copies an untrusted comm string into a fixed 20-byte COMM_LEN buffer. Allocation failure hit a BUG_ON, and a bad realloc pattern left nr_tasks incremented over a leaked pointer. The fix caps pid at PID_MAX_LIMIT, uses strlcpy, and returns NULL instead of crashing. This is the userspace perf binary, not the kernel: it only bites an operator who runs perf sched on a profile handed to them by someone else - a tenant's uploaded trace, a support bundle, an artifact from a shared profiling pipeline. On a GPU node where profiling traces move between tenants and the performance team, that path is real but deliberate; there is no remote or unprivileged-tenant trigger.

Who can reach it

A local user who runs perf sched over a perf.data file supplied by an attacker. Code execution would be in the context of whoever runs perf, which is often root on a GPU node. No authentication bypass and no remote path.

What to do

Update the perf userspace package from your distribution once it carries the fix (five stable commits are linked); this is a package update, not a kernel change, so no reboot or drain is needed. As an operational mitigation, do not run perf sched as root on profiles from an untrusted source - analyse them as an unprivileged user or in a throwaway container.

References

Related entries

• Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class inCVE-2024-49571 · Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt)Critical
• Go x/crypto ssh/agent: destination restrictions silently dropped when adding keys to a remote agentCVE-2026-39832 · golang.org/x/crypto/ssh/agent (constraint extension serialization)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.c: The discovery controller validatedCVE-2026-64320 · Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.cCritical
• perf tools: out-of-bounds heap read parsing a crafted perf.data CPU indexCVE-2026-80670 · Linux kernel perf tools (machine__resolve() CPU index from perf.data samples)Critical
• Linux NFSD: NFSv2 SETATTR reaches notify_change without a mount write referenceCVE-2026-89697 · Linux kernel NFSD (nfsd_proc_setattr, NFSv2 BOTH_TIME_SET path)Critical