---
id: CVE-2026-64300
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf/aux: Fix page UAF in map_range()

  map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via
  perf_mmap_to_page() while holding only event->mmap_mute…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf/aux: Fix page UAF in map_range()

  map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via
  perf_mmap_to_page() while holding only event->mmap_mute…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-07-25'
updated: '2026-07-27'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64300'
references:
  - url: 'https://git.kernel.org/stable/c/0cff05bd2186020f8706233e261016d149cc24db'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5948aaf64f81f217a25dcc2bf6c0779bca19566c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c8b7e113f7b61eef2f017e6329c27c2331058c5a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64300.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64300'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2507040'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64300'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64300'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026072506-CVE-2026-64300-c4cc@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:54343'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00182
epssPercentile: 0.06926
ingestedAt: '2026-07-27T06:16:50.246Z'
vendor: Red Hat
product: Red Hat Enterprise Linux BaseOS (v. 10)
affected:
  - enterprise_linux_appstream_v_10
  - enterprise_linux_baseos_v_10
  - enterprise_linux_codeready_linux_builder_v_10
  - enterprise_linux_real_time_for_nfv_v_10
  - enterprise_linux_real_time_v_10
patched:
  - enterprise_linux_appstream_v_10
  - enterprise_linux_baseos_v_10
  - enterprise_linux_codeready_linux_builder_v_10
  - enterprise_linux_real_time_for_nfv_v_10
  - enterprise_linux_real_time_v_10
cwe:
  - CWE-825
scores:
  nvd: 7.8
  vendor: 7
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

perf/aux: Fix page UAF in map_range()

map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via
perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are
serialized by rb->aux_mutex, and mmap_mutex is per event.

Thus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race
rb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows:

  CPU 0                           CPU 1
  =====                           =====
  rb_alloc_aux()                  map_range()
  [1]: allocate rb->aux_pages[0]
  [2]: rb->aux_nr_pages++
                                  [3]: perf_mmap_to_page()
                                         returns rb->aux_pages[0]
                                  [4]: map it as VM_PFNMAP
  [5]: rb->aux_pgoff = 1

  munmap the page
  [6]: free rb->aux_pages[0]

Pages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a
mapping to a freed physical frame.

Fix this by taking rb->aux_mutex across the page walk in map_range().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:54343** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54343)