CVE-2026-64300
In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_mutex, and mmap_mutex is per event. Thus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race rb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows: CPU 0 CPU 1 ===== ===== rb_alloc_aux() map_range() [1]: allocate rb->aux_pages[0] [2]: rb->aux_nr_pages++ [3]: perf_mmap_to_page() returns rb->aux_pages[0] [4]: map it as VM_PFNMAP [5]: rb->aux_pgoff = 1 munmap the page [6]: free rb->aux_pages[0] Pages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a mapping to a freed physical frame. Fix this by taking rb->aux_mutex across the page walk in map_range().
Affected versions
Linux kernel versions
6.14
and later are affected. Fixed in
6.18.39,
7.1.4,
7.2-rc3
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-64300?
CVE-2026-64300 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.14 onward and has been patched in 6.18.39, 7.1.4 and 7.2-rc3. CVE-2026-64300 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64300?
Yes. CVE-2026-64300 has been patched. Fixed versions include 6.18.39, 7.1.4 and 7.2-rc3. If you are running Linux kernel 6.14 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64300 actively exploited?
No. CVE-2026-64300 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.