CVE-2026-89791

A flaw was found in the Linux kernel's perf subsystem. A race condition exists between the perf mmap() revival and the last munmap() operation. This allows a local unprivileged user to exploit a use-after-free vulnerability, leading to local privilege escalation to root.

A race condition in the Linux kernel's perf subsystem allows a local unprivileged user to escalate privileges to root, an impact rated IMPORTANT by Red Hat. perf_mmap_close() drops the ring buffer's mmap_count without holding event->mmap_mutex, so a concurrent perf mmap() revival can complete within that window; the closing path then frees the newly allocated ring buffer while another process still has it mapped, resulting in a page-level use-after-free. With the default kernel.perf_event_paranoid=2 setting, any unprivileged local user can trigger this race, and successful exploitation leads to full compromise of the confidentiality, integrity, and availability of the system. The kernel component in Red Hat Enterprise Linux 10.2.z, 10.3.z, and 10.4 and in Red Hat In-Vehicle OS 2.0.z and 2.1 (including the kernel-ivos-qualcomm variant) is affected, and a fix is being pursued in those streams. Other Red Hat Enterprise Linux kernel and kernel-rt streams and the RHEL CoreOS kernels shipped with OpenShift Container Platform are not affected because the vulnerable code is not present in those kernels. Red Hat assigns this flaw a CVSS 3.1 base score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the upstream score of 7.8, because reliable exploitation requires winning a narrow timing race between concurrent mmap() and munmap() operations, which Red Hat rates as high attack complexity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.