Executive brief
A vulnerability exists in the Linux kernel's performance monitoring subsystem (perf) that could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly manages memory during specific performance tracking operations, leading to a 'use-after-free' condition. This could impact the stability of the operating system and the security of data handled by the kernel.
Technical details
A race condition exists in 'kernel/events/core.c' within the 'perf_mmap' function. The vulnerability is caused by the 'mmap_mutex' being released prematurely before the 'map_range' operation is complete. If 'map_range' fails, a concurrent thread can access the 'event->rb' pointer and increment its reference count after it has already been slated for cleanup. This results in a refcount-on-zero or use-after-free (UAF) condition. Attackers with local access can exploit this race during concurrent mmap() calls on dependent events or output redirections. The fix involves extending the mutex scope to ensure the ring buffer initialization and mapping are performed atomically.
Affected products
- Linux Linux Kernel 6.14 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1
Timeline
- 2026-03-18: advisory: Initial disclosure via kernel.org and NVD
- 2026-02-23: patched: Fix committed to mainline kernel tree