PT-2026-26051 · Linux · Linux Kernel
Syzkaller
·
Published
2026-01-01
·
Updated
2026-04-20
·
CVE-2026-23248
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux Kernel (affected versions not specified)
Description
The Linux kernel contains a flaw in the perf/core subsystem related to ring buffer management. A race condition can occur between a failing
mmap() setup and a concurrent mmap() on a dependent event, potentially leading to a use-after-free or refcount saturation. Specifically, the issue arises when the map range() function fails after the ring buffer (rb) has been allocated and assigned to event->rb, but before the mmap mutex is reacquired. This allows another thread to access and increment the reference count of a ring buffer that has already been freed. The fix involves extending the scope of the mmap mutex to cover the map range() call, ensuring atomic initialization and cleanup of the ring buffer. The perf mmap() function and the perf mmap close() function are involved in this issue.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel