Linux kernel perf: use-after-free on the perf ring buffer when mmap setup fails during a concurrent attach

Impact

perf_mmap() assigns the new ring buffer to event->rb, then drops mmap_mutex to call map_range(). If map_range() fails, the cleanup path drops the refcount to zero, but in the window where the mutex is not held another thread attaching to the same event - via inherited events or output redirection - can see the still-valid event->rb and take a reference on it. Syzkaller reproduced it as a refcount addition on 0, the classic precursor to a use-after-free on freed kernel memory. For a GPU fleet this matters wherever profiling is allowed to unprivileged users or inside containers: perf is routinely opened up so tenants can profile CUDA and framework workloads, and that same access is the exploit surface for a local privilege escalation on a shared node.

Who can reach it

Local user able to call perf_event_open and mmap the result - unprivileged if perf_event_paranoid is relaxed or the container is granted CAP_PERFMON, which is common on nodes where tenants profile their own jobs. Not reachable over the network.

What to do

Apply the stable kernel update that holds mmap_mutex across map_range(); three stable branches carry the fix. Rollout is drain, install kernel, reboot the node. Until the window can be scheduled, tightening kernel.perf_event_paranoid and dropping CAP_PERFMON from tenant containers removes unprivileged access to the path, at the cost of taking profiling away from tenants.

References

Related entries

• Linux kernel perf: software events run the overflow path with IRQs enabled, racing teardown of the event's BPF programCVE-2026-23271 · Linux kernel perf (__perf_event_overflow vs perf_remove_from_context)High
• Linux kernel io_uring: task-work flag write can land on freed rings during a concurrent ring resizeCVE-2026-23275 · Linux kernel io_uring (ring resize vs task-work flag update)High
• Linux kernel vmwgfx: failed handle lookup returns success, leading to uninitialized and out-of-bounds accessCVE-2026-23317 · Linux kernel vmwgfx (vmw_translate_ptr error path)High
• Linux kernel (drivers/iommu): Unbinding shared virtual addressing touches the mm's IOMMU state after the domain-freeCVE-2026-23429 · Linux kernel (drivers/iommu)High
• Linux kernel NFSD: reads on an open /proc/fs/nfs/exports fd walk a freed export cache after netns teardownCVE-2026-31403 · Linux kernel NFSD (/proc/fs/nfs/exports namespace reference)High
• Linux kernel (net/xfrm): Flushing xfrm states during namespace cleanup re-arms the NAT-keepalive delayed work after itCVE-2026-31406 · Linux kernel (net/xfrm)High