CVE-2026-23248
published 2026-03-18CVE-2026-23248: In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a refcount_t…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a refcount_t: addition on 0; use-after-free warning
in perf_mmap.
The issue is caused by a race condition between a failing mmap() setup
and a concurrent mmap() on a dependent event (e.g., using output
redirection).
In perf_mmap(), the ring_buffer (rb) is allocated and assigned to
event->rb with the mmap_mutex held. The mutex is then released to
perform map_range().
If map_range() fails, perf_mmap_close() is called to clean up.
However, since the mutex was dropped, another thread attaching to
this event (via inherited events or output redirection) can acquire
the mutex, observe the valid event->rb pointer, and attempt to
increment its reference count. If the cleanup path has already
dropped the reference count to zero, this results in a
use-after-free or refcount saturation warning.
Fix this by extending the scope of mmap_mutex to cover the
map_range() call. This ensures that the ring buffer initialization
and mapping (or cleanup on failure) happens atomically effectively,
preventing other threads from accessing a half-initialized or
dying ring buffer.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= b709eb872e19a19607bbb6d2975bc264d59735cf < c27dea9f50ed525facb62ef647dddc4722456e07 | c27dea9f50ed525facb62ef647dddc4722456e07 |
| linux | linux | >= b709eb872e19a19607bbb6d2975bc264d59735cf < ac7ecb65af170a7fc193e7bd8be15dac84ec6a56 | ac7ecb65af170a7fc193e7bd8be15dac84ec6a56 |
| linux | linux | >= b709eb872e19a19607bbb6d2975bc264d59735cf < 77de62ad3de3967818c3dbe656b7336ebee461d2 | 77de62ad3de3967818c3dbe656b7336ebee461d2 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 6.14 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.14.0 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.19 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.19.0 < 6.19.7 | 6.19.7 |
| msrc | azl3_kernel_6.6.126.1-1_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
vendor_msrc7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.18.16/6.19.6/7.0-rc1 perf mmap use after free (EUVD-2026-12811 / Nessus ID 302906)
vuldb·2026-06-24·CVSS 7.8
CVE-2026-23248 [HIGH] Linux Kernel up to 6.18.16/6.19.6/7.0-rc1 perf mmap use after free (EUVD-2026-12811 / Nessus ID 302906)
A vulnerability classified as critical has been found in Linux Kernel up to 6.18.16/6.19.6/7.0-rc1. This impacts the function mmap of the component perf. Performing a manipulation results in use after free.
This vulnerability is known as CVE-2026-23248. Access to the local network is required for this attack. No exploit is available.
It is recommended to upgrade the affected component.
OSV
perf/core: Fix refcount bug and potential UAF in perf_mmap
osv·2026-03-18·CVSS 7.8
CVE-2026-23248 [HIGH] perf/core: Fix refcount bug and potential UAF in perf_mmap
perf/core: Fix refcount bug and potential UAF in perf_mmap
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a refcount_t: addition on 0; use-after-free warning
in perf_mmap.
The issue is caused by a race condition between a failing mmap() setup
and a concurrent mmap() on a dependent event (e.g., using output
redirection).
In perf_mmap(), the ring_buffer (rb) is allocated and assigned to
event->rb with the mmap_mutex held. The mutex is then released to
perform map_range().
If map_range() fails, perf_mmap_close() is called to clean up.
However, since the mutex was dropped, another thread attaching to
this event (via inherited events or output redirection) can acquire
the mutex, observe the
GHSA
GHSA-78fw-h7fp-fffh: In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a
ghsa_unreviewed·2026-03-18
CVE-2026-23248 [HIGH] GHSA-78fw-h7fp-fffh: In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a refcount_t: addition on 0; use-after-free warning
in perf_mmap.
The issue is caused by a race condition between a failing mmap() setup
and a concurrent mmap() on a dependent event (e.g., using output
redirection).
In perf_mmap(), the ring_buffer (rb) is allocated and assigned to
event->rb with the mmap_mutex held. The mutex is then released to
perform map_range().
If map_range() fails, perf_mmap_close() is called to clean up.
However, since the mutex was dropped, another thread attaching to
this event (via inherited events or output redirection) can acquire
the mutex, observe the valid event->rb pointer, and attempt to
increment its refere
OSV
CVE-2026-23248: In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a re
osv·2026-03-18·CVSS 7.8
CVE-2026-23248 [HIGH] CVE-2026-23248: In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a re
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a refcount_t: addition on 0; use-after-free warning in perf_mmap. The issue is caused by a race condition between a failing mmap() setup and a concurrent mmap() on a dependent event (e.g., using output redirection). In perf_mmap(), the ring_buffer (rb) is allocated and assigned to event->rb with the mmap_mutex held. The mutex is then released to perform map_range(). If map_range() fails, perf_mmap_close() is called to clean up. However, since the mutex was dropped, another thread attaching to this event (via inherited events or output redirection) can acquire the mutex, observe the valid event->rb pointer, and attempt to increment its reference c
Red Hat
kernel: perf/core: Fix refcount bug and potential UAF in perf_mmap
vendor_redhat·2026-03-18·CVSS 7.8
CVE-2026-23248 [HIGH] CWE-911 kernel: perf/core: Fix refcount bug and potential UAF in perf_mmap
kernel: perf/core: Fix refcount bug and potential UAF in perf_mmap
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a refcount_t: addition on 0; use-after-free warning
in perf_mmap.
The issue is caused by a race condition between a failing mmap() setup
and a concurrent mmap() on a dependent event (e.g., using output
redirection).
In perf_mmap(), the ring_buffer (rb) is allocated and assigned to
event->rb with the mmap_mutex held. The mutex is then released to
perform map_range().
If map_range() fails, perf_mmap_close() is called to clean up.
However, since the mutex was dropped, another thread attaching to
this event (via inherited events or output redirection) can acquire
the mutex, observe t
Microsoft
perf/core: Fix refcount bug and potential UAF in perf_mmap
vendor_msrc·2026-03-10·CVSS 7.0
CVE-2026-23248 [HIGH] perf/core: Fix refcount bug and potential UAF in perf_mmap
perf/core: Fix refcount bug and potential UAF in perf_mmap
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-23248: linux - In the Linux kernel, the following vulnerability has been resolved: perf/core: ...
vendor_debian·2026·CVSS 7.8
CVE-2026-23248 [HIGH] CVE-2026-23248: linux - In the Linux kernel, the following vulnerability has been resolved: perf/core: ...
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a refcount_t: addition on 0; use-after-free warning in perf_mmap. The issue is caused by a race condition between a failing mmap() setup and a concurrent mmap() on a dependent event (e.g., using output redirection). In perf_mmap(), the ring_buffer (rb) is allocated and assigned to event->rb with the mmap_mutex held. The mutex is then released to perform map_range(). If map_range() fails, perf_mmap_close() is called to clean up. However, since the mutex was dropped, another thread attaching to this event (via inherited events or output redirection) can acquire the mutex, observe the valid event->rb pointer, and attempt to increment its reference c
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-23248 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2026-23248 [HIGH] CVE-2026-23248 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23248 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a refcount_t: addition on 0; use-after-free warning
in perf_mmap.
The issue is caused by a race condition between a failing mmap() setup
and a concurrent mmap() on a dependent event (e.g., using output
redirection).
In perf_mmap(), the ring_buffer (rb) is allocated and assigned to
event->rb with the mmap_mutex held. The mutex is then released to
perform map_range().
If map_range() fails, perf_mmap_close() is called to clean up.
However, since the mutex was dropped, another thread attaching to
this event (via inherited events or output redirection) can acquire
the mutex,
Bugzilla
CVE-2026-23248 kernel: perf/core: Fix refcount bug and potential UAF in perf_mmap
bugzilla·2026-03-18·CVSS 7.8
CVE-2026-23248 [HIGH] CVE-2026-23248 kernel: perf/core: Fix refcount bug and potential UAF in perf_mmap
CVE-2026-23248 kernel: perf/core: Fix refcount bug and potential UAF in perf_mmap
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a refcount_t: addition on 0; use-after-free warning
in perf_mmap.
The issue is caused by a race condition between a failing mmap() setup
and a concurrent mmap() on a dependent event (e.g., using output
redirection).
In perf_mmap(), the ring_buffer (rb) is allocated and assigned to
event->rb with the mmap_mutex held. The mutex is then released to
perform map_range().
If map_range() fails, perf_mmap_close() is called to clean up.
However, since the mutex was dropped, another thread attaching to
this event (via inherited events or output redirection) can acquire
2026-03-18
Published