CVE-2026-64300

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the map range() function where it accesses rb->aux pages[], rb->aux nr pages, and rb->aux pgoff via perf mmap to page() while holding only the event->mmap mutex. Because these fields are serialized by rb->aux mutex and the mmap mutex is per event, a race condition can occur between rb alloc aux() and map range() when two events share one ring buffer via PERF EVENT IOC SET OUTPUT. This leads to a Use-After-Free (UAF) scenario where a page mapped as VM PFNMAP (a mapping that maps a physical page frame directly into the virtual address space without using the standard page table reference counting) is freed while a mapping to that physical frame is still held.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.