CVE-2026-23248

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix refcount bug and potential UAF in perf_mmap

Syzkaller reported a refcount_t: addition on 0; use-after-free warning

in perf_mmap.

The issue is caused by a race condition between a failing mmap() setup

and a concurrent mmap() on a dependent event (e.g., using output

redirection).

In perf_mmap(), the ring_buffer (rb) is allocated and assigned to

event->rb with the mmap_mutex held. The mutex is then released to

perform map_range().

If map_range() fails, perf_mmap_close() is called to clean up.

However, since the mutex was dropped, another thread attaching to

this event (via inherited events or output redirection) can acquire

the mutex, observe the valid event->rb pointer, and attempt to

increment its reference count. If the cleanup path has already

dropped the reference count to zero, this results in a

use-after-free or refcount saturation warning.

Fix this by extending the scope of mmap_mutex to cover

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References