Use After Free in Linux kernel - CVE-2026-23248
Published: March 20, 2026
Vulnerability details
The vulnerability allows a local user to execute arbitrary code or escalate privileges.
The vulnerability exists due to a use-after-free in the perf_mmap component when handling concurrent mmap() operations on dependent events. A local user can trigger a race condition during failing mmap() setup to execute arbitrary code or escalate privileges.
The vulnerability specifically involves improper synchronization in the ring buffer reference counting mechanism, where dropping the mmap_mutex before map_range() allows a concurrent thread to access a partially initialized or freed ring buffer. Exploitation requires concurrent access to perf events, such as through inherited events or output redirection, and may require low-privileged local access.