CVE-2026-80670

In the Linux kernel, the following vulnerability has been resolved:

perf tools: Use perf_envgetcputopology() in machineresolve()

machine_resolve() accesses env->cpu[al->cpu].socketid after checking al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu against env->nrcpusavail. Since al->cpu comes from the untrusted perf.data sample, a crafted file with a large CPU index causes an out-of-bounds heap read.

Use perf_env__getcputopology() which validates both NULL and bounds. Also bounds-check al->cpu before the cast to struct perfcpu (int16t): without this, values like 65536 silently truncate to 0, bypassing the accessor's internal check and returning CPU 0's topology.