{"id":"CVE-2026-64300","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/aux: Fix page UAF in map_range()\n\nmap_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via\nperf_mmap_to_page() while holding only event->mmap_mute…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/aux: Fix page UAF in map_range()\n\nmap_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via\nperf_mmap_to_page() while holding only event->mmap_mute…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","published":"2026-07-25","updated":"2026-07-27","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64300","references":[{"url":"https://git.kernel.org/stable/c/0cff05bd2186020f8706233e261016d149cc24db","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5948aaf64f81f217a25dcc2bf6c0779bca19566c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8b7e113f7b61eef2f017e6329c27c2331058c5a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64300.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64300"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507040"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64300"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64300"},{"url":"https://lore.kernel.org/linux-cve-announce/2026072506-CVE-2026-64300-c4cc@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:54343"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00182,"epssPercentile":0.0803,"ingestedAt":"2026-07-27T06:16:50.246Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 10)","affected":["enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_v_10"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_v_10"],"cwe":["CWE-825"],"scores":{"nvd":7.8,"vendor":7},"slug":"CVE-2026-64300","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/aux: Fix page UAF in map_range()\n\nmap_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via\nperf_mmap_to_page() while holding only event->mmap_mutex. Those fields are\nserialized by rb->aux_mutex, and mmap_mutex is per event.\n\nThus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race\nrb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows:\n\n  CPU 0                           CPU 1\n  =====                           =====\n  rb_alloc_aux()                  map_range()\n  [1]: allocate rb->aux_pages[0]\n  [2]: rb->aux_nr_pages++\n                                  [3]: perf_mmap_to_page()\n                                         returns rb->aux_pages[0]\n                                  [4]: map it as VM_PFNMAP\n  [5]: rb->aux_pgoff = 1\n\n  munmap the page\n  [6]: free rb->aux_pages[0]\n\nPages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a\nmapping to a freed physical frame.\n\nFix this by taking rb->aux_mutex across the page walk in map_range().\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:54343** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54343)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}