PT-2026-64521 · Linux · Linux
CVE-2026-64300
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
perf/aux: Fix page UAF in map range()
map range() reads rb->aux pages[], rb->aux nr pages and rb->aux pgoff via
perf mmap to page() while holding only event->mmap mutex. Those fields are
serialized by rb->aux mutex, and mmap mutex is per event.
Thus, two events sharing one rb via PERF EVENT IOC SET OUTPUT can race
rb alloc aux() with map range(), leading to a page-UAF scenario as follows:
CPU 0 CPU 1
===== =====
rb alloc aux() map range()
[1]: allocate rb->aux pages[0]
[2]: rb->aux nr pages++
[3]: perf mmap to page()
returns rb->aux pages[0]
[4]: map it as VM PFNMAP
[5]: rb->aux pgoff = 1
munmap the page
[6]: free rb->aux pages[0]
Pages mapped as VM PFNMAP have no refcount protection, so CPU 1 holds a
mapping to a freed physical frame.
Fix this by taking rb->aux mutex across the page walk in map range().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux