CVE-2026-64300

In the Linux kernel, the following vulnerability has been resolved:

perf/aux: Fix page UAF in map_range()

maprange() reads rb->auxpages[], rb->auxnrpages and rb->auxpgoff via perfmmaptopage() while holding only event->mmapmutex. Those fields are serialized by rb->auxmutex, and mmap_mutex is per event.

Thus, two events sharing one rb via PERFEVENTIOCSETOUTPUT can race rballocaux() with map_range(), leading to a page-UAF scenario as follows:

CPU 0 CPU 1 ===== ===== rballocaux() maprange() [3]: perfmmaptopage() returns rb->auxpages[0] [4]: map it as VMPFNMAP munmap the page Pages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a mapping to a freed physical frame.

Fix this by taking rb->auxmutex across the page walk in maprange().