CVE-2026-89791

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix use-after-free when perf mmap() revival races with the last munmap()

perf_mmap_close() drops rb->mmap_count *without* holding

event->mmap_mutex (the refcount_dec_and_test() right before the

refcount_dec_and_mutex_lock() of event->mmap_count). A concurrent

perf_mmap_rb() can slot its entire "revival" path into that window

(perf_mmap holds event->mmap_mutex for its whole duration, including

rb_alloc):

munmap side (perf_mmap_close) mmap side (perf_mmap_rb)

----------------------------------- --------------------------------

rb->mmap_count 1 -> 0 (no lock) (holds event->mmap_mutex)

inc_not_zero(rb->mmap_count) fails

ring_buffer_attach(event, NULL)

rb_alloc() + attach new rb

refcount_set(&event->mmap_count, 1)

lock; event->

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References