{"id":"CVE-2026-64300","summary":"perf/aux: Fix page UAF in map_range()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/aux: Fix page UAF in map_range()\n\nmap_range() reads rb-\u003eaux_pages[], rb-\u003eaux_nr_pages and rb-\u003eaux_pgoff via\nperf_mmap_to_page() while holding only event-\u003emmap_mutex. Those fields are\nserialized by rb-\u003eaux_mutex, and mmap_mutex is per event.\n\nThus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race\nrb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows:\n\n  CPU 0                           CPU 1\n  =====                           =====\n  rb_alloc_aux()                  map_range()\n  [1]: allocate rb-\u003eaux_pages[0]\n  [2]: rb-\u003eaux_nr_pages++\n                                  [3]: perf_mmap_to_page()\n                                         returns rb-\u003eaux_pages[0]\n                                  [4]: map it as VM_PFNMAP\n  [5]: rb-\u003eaux_pgoff = 1\n\n  munmap the page\n  [6]: free rb-\u003eaux_pages[0]\n\nPages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a\nmapping to a freed physical frame.\n\nFix this by taking rb-\u003eaux_mutex across the page walk in map_range().","modified":"2026-07-27T04:03:21.429257620Z","published":"2026-07-25T08:49:36.372Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64300.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0cff05bd2186020f8706233e261016d149cc24db"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5948aaf64f81f217a25dcc2bf6c0779bca19566c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c8b7e113f7b61eef2f017e6329c27c2331058c5a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64300.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64300"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b709eb872e19a19607bbb6d2975bc264d59735cf"},{"fixed":"c8b7e113f7b61eef2f017e6329c27c2331058c5a"},{"fixed":"0cff05bd2186020f8706233e261016d149cc24db"},{"fixed":"5948aaf64f81f217a25dcc2bf6c0779bca19566c"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64300.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.18.39"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64300.json"}}],"schema_version":"1.7.5"}