Linux kernel perf AUX buffer: missing aux_mutex in map_range lets a local user map a freed page

Impact

map_range() walks rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff holding only the per-event mmap_mutex, while those fields are serialized by rb->aux_mutex. Two events sharing one ring buffer through PERF_EVENT_IOC_SET_OUTPUT can therefore race rb_alloc_aux() against the mmap and install a mapping to a page that is subsequently freed. The mapping is VM_PFNMAP, which carries no refcount, so the process keeps read/write access to a physical frame after it is returned to the allocator and reused - a straightforward local privilege escalation primitive, or a host crash. This matters on GPU nodes because profiling is often deliberately left reachable for tenants so Nsight and perf workflows function: relaxed kernel.perf_event_paranoid, or CAP_PERFMON granted to profiling pods. Where perf_event_open is root-only, so is this bug. An AUX-capable PMU (Intel PT, Arm SPE/CoreSight) must be present for the AUX path to exist at all.

Who can reach it

Local user on the node who can call perf_event_open - unprivileged if perf_event_paranoid is relaxed or the pod holds CAP_PERFMON, otherwise root. No network path. Requires an AUX-capable PMU on the host.

What to do

Take a stable kernel carrying the fix (commits linked in the record) and reboot each node; perf is core kernel with no module to unload, so this is a drain-and-reboot per node, not a hot patch. Cheap interim mitigation that needs no maintenance window: set kernel.perf_event_paranoid=3 and drop CAP_PERFMON from tenant pods, which closes the path at the cost of tenant profiling.

References

Related entries

• Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffersCVE-2026-64304 · Linux kernel crypto qat driver (RSA CRT key setup, qat_rsa_setkey_crt)High
• Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entriesCVE-2026-64305 · Linux kernel Intel QAT driver (adf service_table list locking)High
• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel iomap: zero-length write range underflows into an out-of-bounds bitmap_set()CVE-2026-68145 · Linux kernel iomap (ifs_set_range_dirty / ifs_set_range_uptodate)High
• Linux kernel libceph: use-after-free reading the monmap debugfs file during client teardownCVE-2026-68153 · Linux kernel libceph (per-client debugfs files vs client teardown)High