Executive brief
The Linux kernel's perf performance monitoring subsystem contains a use-after-free vulnerability in memory mapping code. An unprivileged user can exploit a race condition during concurrent mmap() and munmap() operations to gain root-level privileges on systems with default security settings.
Technical details
The vulnerability is a use-after-free condition in perf_mmap_close() and perf_mmap_rb() arising from a race condition in refcount management. perf_mmap_close() decrements rb->mmap_count without holding event->mmap_mutex, allowing a concurrent perf_mmap_rb() call to complete a "revival" path that reattaches a ring buffer and resets event->mmap_count, which is then freed by the continuing close operation. This leaves the revived buffer mapped in user-space but freed in kernel memory, allowing page-level exploitation for privilege escalation. The fix reorders the counter updates so that event->mmap_count is decremented first under the mutex, serializing the race. The attack requires only local access and works against default kernel configurations (kernel.perf_event_paranoid=2).
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-09-16: disclosed
- patched: Fix swaps order of refcount updates in perf_mmap_close()