CVE-2026-23248
Use-After-Free in Linux Kernel perf_mmap Causes Race Condition
Publication date: 2026-03-18
Last updated on: 2026-04-02
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's perf subsystem, specifically in the perf_mmap function. It is caused by a race condition during the setup of memory mapping (mmap) for performance events. When a ring buffer is allocated and assigned to an event, the mutex protecting this operation is released before the memory mapping is completed. If the mapping fails, cleanup occurs, but because the mutex is no longer held, another thread can concurrently access the event's ring buffer pointer and increment its reference count even after it has been freed. This leads to a use-after-free condition or a reference count saturation warning.
The fix involves extending the scope of the mutex to cover the entire memory mapping operation, ensuring that initialization and cleanup happen atomically and preventing other threads from accessing a partially initialized or freed ring buffer.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges. Exploiting this flaw could compromise the security and reliability of systems running vulnerable Linux kernel versions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a race condition in the Linux kernel's perf_mmap function, which has been fixed by extending the scope of the mmap_mutex to cover the map_range() call. To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.
This update ensures that the ring buffer initialization and mapping (or cleanup on failure) happens atomically, preventing use-after-free conditions or refcount saturation warnings.