CVE-2026-64300

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> perf/aux: Fix page UAF in map_range()<br /> <br /> map_range() reads rb-&gt;aux_pages[], rb-&gt;aux_nr_pages and rb-&gt;aux_pgoff via<br /> perf_mmap_to_page() while holding only event-&gt;mmap_mutex. Those fields are<br /> serialized by rb-&gt;aux_mutex, and mmap_mutex is per event.<br /> <br /> Thus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race<br /> rb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows:<br /> <br /> CPU 0 CPU 1<br /> ===== =====<br /> rb_alloc_aux() map_range()<br /> [1]: allocate rb-&gt;aux_pages[0]<br /> [2]: rb-&gt;aux_nr_pages++<br /> [3]: perf_mmap_to_page()<br /> returns rb-&gt;aux_pages[0]<br /> [4]: map it as VM_PFNMAP<br /> [5]: rb-&gt;aux_pgoff = 1<br /> <br /> munmap the page<br /> [6]: free rb-&gt;aux_pages[0]<br /> <br /> Pages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a<br /> mapping to a freed physical frame.<br /> <br /> Fix this by taking rb-&gt;aux_mutex across the page walk in map_range().