CVE-2026-23248

A use-after-free vulnerability was found in the Linux kernel's perf subsystem. A race condition exists in perf_mmap() between a failing mmap() setup and concurrent mmap() operations on dependent events. When map_range() fails, the cleanup path runs while the mmap_mutex is released, allowing another thread to observe and access a ring buffer whose reference count has already reached zero. This can result in use-after-free or refcount corruption.

This flaw was discovered by syzkaller and affects the perf event subsystem used for performance monitoring. The race requires concurrent mmap operations on related perf events (via inheritance or output redirection), making exploitation timing-sensitive but achievable. Successful exploitation could lead to kernel memory corruption or information disclosure through the freed ring buffer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.