CVE-2026-23248
Analyzed Analyzed - Analysis Complete
Use-After-Free in Linux Kernel perf_mmap Causes Race Condition

Publication date: 2026-03-18

Last updated on: 2026-05-21

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a refcount_t: addition on 0; use-after-free warning in perf_mmap. The issue is caused by a race condition between a failing mmap() setup and a concurrent mmap() on a dependent event (e.g., using output redirection). In perf_mmap(), the ring_buffer (rb) is allocated and assigned to event->rb with the mmap_mutex held. The mutex is then released to perform map_range(). If map_range() fails, perf_mmap_close() is called to clean up. However, since the mutex was dropped, another thread attaching to this event (via inherited events or output redirection) can acquire the mutex, observe the valid event->rb pointer, and attempt to increment its reference count. If the cleanup path has already dropped the reference count to zero, this results in a use-after-free or refcount saturation warning. Fix this by extending the scope of mmap_mutex to cover the map_range() call. This ensures that the ring buffer initialization and mapping (or cleanup on failure) happens atomically effectively, preventing other threads from accessing a half-initialized or dying ring buffer.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-05-21
Generated
2026-06-16
AI Q&A
2026-03-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23248
EUVD
EUVD-2026-12811
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.19 (inc) to 6.19.7 (exc)
linux linux_kernel 7.0
linux linux_kernel From 6.14 (inc) to 6.18.17 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's perf subsystem, specifically in the perf_mmap function. It is caused by a race condition during the setup of memory mapping (mmap) for performance events. When a ring buffer is allocated and assigned to an event, the mutex protecting this operation is released before the memory mapping is completed. If the mapping fails, cleanup occurs, but because the mutex is no longer held, another thread can concurrently access the event's ring buffer pointer and increment its reference count even after it has been freed. This leads to a use-after-free condition or a reference count saturation warning.

The fix involves extending the scope of the mutex to cover the entire memory mapping operation, ensuring that initialization and cleanup happen atomically and preventing other threads from accessing a partially initialized or freed ring buffer.

Impact Analysis

This vulnerability can lead to a use-after-free condition in the Linux kernel, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges. Exploiting this flaw could compromise the security and reliability of systems running vulnerable Linux kernel versions.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability is caused by a race condition in the Linux kernel's perf_mmap function, which has been fixed by extending the scope of the mmap_mutex to cover the map_range() call. To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

This update ensures that the ring buffer initialization and mapping (or cleanup on failure) happens atomically, preventing use-after-free conditions or refcount saturation warnings.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23248. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart