Executive brief
A vulnerability was identified in the Linux kernel's performance monitoring subsystem (perf). This flaw could allow a local attacker to trigger a 'use-after-free' condition, potentially leading to a system crash or unauthorized access to memory. The issue occurs when multiple performance events compete for the same memory resources, causing the system to reference memory that has already been released.
Technical details
A race condition exists in the map_range() function within kernel/events/core.c of the Linux kernel. The vulnerability occurs because map_range() accesses auxiliary buffer fields (rb->aux_pages, rb->aux_nr_pages, and rb->aux_pgoff) while only holding the per-event mmap_mutex, whereas these fields are actually serialized by the shared rb->aux_mutex. When two events share a ring buffer via PERF_EVENT_IOC_SET_OUTPUT, an attacker can race rb_alloc_aux() against map_range(). This results in a page being mapped as VM_PFNMAP without proper reference counting, allowing a process to maintain a mapping to a physical frame after it has been freed. This use-after-free (UAF) can be exploited locally to cause a denial of service or potentially escalate privileges. The fix involves properly acquiring rb->aux_mutex during the page walk in map_range().
Affected products
- Linux Linux Kernel 6.14, 6.18.39, 7.1.4
Timeline
- 2026-07-09: other: Vulnerability reported by Lee Jia Jie
- 2026-07-25: disclosed: CVE published and patches integrated into stable trees