Linux kernel perf: use-after-free when an mmap revival races the last munmap, giving local root

Impact

perf_mmap_close() drops the ring buffer's mmap_count without holding event->mmap_mutex, so a concurrent perf_mmap() that re-attaches a freshly allocated ring buffer can have that new buffer freed underneath it while it is still mapped. The result is a page-level use-after-free that the commit message describes as local privilege escalation to root, reachable by an unprivileged user under the default kernel.perf_event_paranoid=2. On a GPU node that matters because any tenant with shell access in a container that has not blocked perf_event_open - profiling and observability workloads routinely need it - can escalate out of their job and reach the driver, the other tenants' GPUs and the node's credentials. Winning the race takes only repeated mmap/munmap of a perf event, no special hardware.

Who can reach it

Local. Any unprivileged user or containerized tenant able to call perf_event_open() and mmap the resulting ring buffer; no special capability is required at the default paranoid setting.

What to do

Take the stable-kernel update carrying the reordered counter drops (event->mmap_count dropped first under refcount_dec_and_mutex_lock). There is no in-tree runtime fix, so this is a kernel upgrade: drain the node's jobs and reboot into the patched kernel, or kexec if your fleet supports it. Until the reboot window, raising kernel.perf_event_paranoid and denying perf_event_open in the container seccomp profile removes reachability for untrusted tenants, at the cost of breaking tenant profiling.

References

Related entries

• Linux kernel BPF: bpf_get_stackid runs get_perf_callchain preemptible, exposing its trace bufferCVE-2026-89799 · Linux kernel BPF (bpf_get_stackid, get_perf_callchain preemption)High
• Linux kernel mm/migrate_device: compound folio at the end of a range writes past the PFN arrayCVE-2026-89967 · Linux kernel mm/migrate_device (device-private page migration)High
• Linux kernel megaraid_sas: NVMe PRP list overruns the chain frame and corrupts other in-flight commandsCVE-2026-90008 · Linux kernel megaraid_sas (NVMe PRP chain frame)High
• Linux kernel SCSI bsg: TOCTOU on the shared io_uring SQE overflows the SCSI command bufferCVE-2026-90009 · Linux kernel SCSI bsg (io_uring passthrough command setup)High
• Linux kernel bsg: sense data copy ignores max_response_len and overruns the user bufferCVE-2026-90010 · Linux kernel SCSI bsg (io_uring sense copy)High
• Linux kernel page allocator: unsafe spin_trylock in NMI context on uniprocessor buildsCVE-2026-90046 · Linux kernel mm/page_alloc (free_pages_nolock in NMI on UP builds)High