{"id":"CVE-2026-23127","summary":"perf: Fix refcount warning on event-\u003emmap_count increment","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix refcount warning on event-\u003emmap_count increment\n\nWhen calling refcount_inc(&event-\u003emmap_count) inside perf_mmap_rb(), the\nfollowing warning is triggered:\n\n        refcount_t: addition on 0; use-after-free.\n        WARNING: lib/refcount.c:25\n\nPoC:\n\n    struct perf_event_attr attr = {0};\n    int fd = syscall(__NR_perf_event_open, &attr, 0, -1, -1, 0);\n    mmap(NULL, 0x3000, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);\n    int victim = syscall(__NR_perf_event_open, &attr, 0, -1, fd,\n                         PERF_FLAG_FD_OUTPUT);\n    mmap(NULL, 0x3000, PROT_READ | PROT_WRITE, MAP_SHARED, victim, 0);\n\nThis occurs when creating a group member event with the flag\nPERF_FLAG_FD_OUTPUT. The group leader should be mmap-ed and then mmap-ing\nthe event triggers the warning.\n\nSince the event has copied the output_event in perf_event_set_output(),\nevent-\u003erb is set. As a result, perf_mmap_rb() calls\nrefcount_inc(&event-\u003emmap_count) when event-\u003emmap_count = 0.\n\nDisallow the case when event-\u003emmap_count = 0. This also prevents two\nevents from updating the same user_page.","modified":"2026-04-02T13:12:04.808788Z","published":"2026-02-14T15:09:56.237Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23127.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/23c0e4bd93d0b250775162faf456470485ac9fc7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d06bf78e55d5159c1b00072e606ab924ffbbad35"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23127.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23127"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"448f97fba9013ffa13f5dd82febd18836b189499"},{"fixed":"23c0e4bd93d0b250775162faf456470485ac9fc7"},{"fixed":"d06bf78e55d5159c1b00072e606ab924ffbbad35"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23127.json"}}],"schema_version":"1.7.5"}