perf sched: integer overflow and strcpy overflow parsing untrusted perf.data

Impact

register_pid() in perf sched trusts values from a perf.data file: (pid + 1) * sizeof(struct task_desc *) can wrap on 32-bit systems so realloc returns a tiny buffer that the init loop then writes past, and strcpy() copies an untrusted comm string into a fixed 20-byte COMM_LEN buffer. Allocation failure hit a BUG_ON, and a bad realloc pattern left nr_tasks incremented over a leaked pointer. The fix caps pid at PID_MAX_LIMIT, uses strlcpy, and returns NULL instead of crashing. This is the userspace perf binary, not the kernel: it only bites an operator who runs perf sched on a profile handed to them by someone else - a tenant's uploaded trace, a support bundle, an artifact from a shared profiling pipeline. On a GPU node where profiling traces move between tenants and the performance team, that path is real but deliberate; there is no remote or unprivileged-tenant trigger.

Who can reach it

A local user who runs perf sched over a perf.data file supplied by an attacker. Code execution would be in the context of whoever runs perf, which is often root on a GPU node. No authentication bypass and no remote path.

What to do

Update the perf userspace package from your distribution once it carries the fix (five stable commits are linked); this is a package update, not a kernel change, so no reboot or drain is needed. As an operational mitigation, do not run perf sched as root on profiles from an untrusted source - analyse them as an unprivileged user or in a throwaway container.

References

Related entries

• Nutanix Prism Element: internal management header grants unauthenticated cluster-admin JWTCVE-2026-84731 · Nutanix Prism Element (AOS authentication filters)Critical
• KVM arm64: negative stage-1 walk level mis-sizes VNCR TLB invalidation to zeroCVE-2026-89775 · Linux kernel KVM arm64 nested virtualization (VNCR TLB invalidation size, pgshift_level_to_ttl)Critical
• KVM arm64: missing VA sign extension in range-based TLB invalidation decodingCVE-2026-89914 · Linux kernel KVM arm64 nested virtualization (decode_range_tlbi VA sign extension)Critical
• Linux kernel KVM/arm64: VM-wide VNCR mapping counter lets TLB invalidations be missed under nested virtCVE-2026-89915 · Linux kernel KVM/arm64 (nested virtualization VNCR TLB invalidation)Critical
• Linux kernel KVM/arm64: VNCR invalidation races nested page fault and installs a stale TLB entryCVE-2026-89916 · Linux kernel KVM/arm64 (VNCR fault vs. invalidation race, mmu_invalidate_seq)Critical
• Linux kernel KVM/arm64: address rollover at the end of VA space makes TLB invalidation by VA silently failCVE-2026-89918 · Linux kernel KVM/arm64 (TLBI range comparison, end of TTBR1 VA space)Critical