CVE-2026-64300

Analyzed Analyzed - Analysis Complete

Page UAF in Linux Kernel perf/aux

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_mutex, and mmap_mutex is per event. Thus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race rb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows: CPU 0 CPU 1 ===== ===== rb_alloc_aux() map_range() [1]: allocate rb->aux_pages[0] [2]: rb->aux_nr_pages++ [3]: perf_mmap_to_page() returns rb->aux_pages[0] [4]: map it as VM_PFNMAP [5]: rb->aux_pgoff = 1 munmap the page [6]: free rb->aux_pages[0] Pages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a mapping to a freed physical frame. Fix this by taking rb->aux_mutex across the page walk in map_range().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64300

EUVD

EUVD-2026-49012

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	7.2
linux	linux_kernel	7.2
linux	linux_kernel	From 6.14 (inc) to 6.18.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's perf subsystem. It occurs when two CPU cores race to access shared memory structures during performance monitoring. One core may free a memory page while another core is still using it, leading to potential crashes or privilege escalation.

Detection Guidance

This vulnerability is specific to the Linux kernel's perf subsystem and requires kernel-level access to detect. There are no direct network-based detection methods. Monitor kernel logs for crashes or memory corruption events related to perf or aux buffers. Check for unusual behavior in processes using perf_event_open() or related tools.

Impact Analysis

An attacker with local access could exploit this to crash the system or gain elevated privileges. Systems using performance monitoring tools are at risk if unpatched. Data corruption or denial of service are possible outcomes.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's perf subsystem, which could lead to memory corruption or privilege escalation. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel memory management flaws.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If patches are unavailable, avoid using PERF_EVENT_IOC_SET_OUTPUT to share ring buffers between events. Restrict access to perf_event_open() via kernel parameters or seccomp policies until patched.

Hi! I’m here to help you understand CVE-2026-64300. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70