Executive brief
The Linux kernel's perf scheduling tool contains multiple memory safety vulnerabilities in the register_pid() function when processing untrusted performance data files. An attacker can craft a malicious perf.data file with specially crafted process IDs or command strings to trigger integer overflow, heap buffer overflow, or denial of service. This could allow code execution or system crash on affected systems that use the perf tool to analyze performance data.
Technical details
The register_pid() function in tools/perf/builtin-sched.c contains four related memory safety issues: (1) integer overflow in heap allocation size calculation where (pid + 1) * sizeof(struct task_desc *) wraps to a small value on 32-bit systems when pid >= 0x40000000, causing out-of-bounds writes; (2) heap buffer overflow via strcpy() into a fixed 20-byte COMM_LEN buffer without bounds checking; (3) BUG_ON() calls that crash the process on allocation failure instead of handling errors gracefully; and (4) unsafe realloc() patterns that leak memory and corrupt state on failure. The vulnerability is triggered by processing untrusted perf.data files. The fix caps pid values at PID_MAX_LIMIT (4194304), replaces strcpy() with strlcpy(), adds NULL checks for allocation failures, and uses safe realloc patterns. Patches have been merged into the Linux kernel stable trees.
Affected products
- Linux Linux kernel affected versions prior to patch (across multiple stable branches from 4.x through 6.x and newer)
Timeline
- 2026-08-28: disclosed
- 2026-09-14: patched: Patch merged into stable kernel trees