PT-2026-64521 · Linux · Linux
CVE-2026-64300
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
perf/aux: Fix page UAF in map range()
map range() reads rb->aux pages[], rb->aux nr pages and rb->aux pgoff via
perf mmap to page() while holding only event->mmap mutex. Those fields are
serialized by rb->aux mutex, and mmap mutex is per event.
Thus, two events sharing one rb via PERF EVENT IOC SET OUTPUT can race
rb alloc aux() with map range(), leading to a page-UAF scenario as follows:
CPU 0 CPU 1
===== =====
rb alloc aux() map range()
[1]: allocate rb->aux pages[0]
[2]: rb->aux nr pages++
[3]: perf mmap to page()
returns rb->aux pages[0]
[4]: map it as VM PFNMAP
[5]: rb->aux pgoff = 1
munmap the page
[6]: free rb->aux pages[0]
Pages mapped as VM PFNMAP have no refcount protection, so CPU 1 holds a
mapping to a freed physical frame.
Fix this by taking rb->aux mutex across the page walk in map range().
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux