High [CVE-2026-64300] Fix page UAF in map_range
This high-severity Red Hat Linux advisory covers CVE-2026-64300 affecting Red Hat Enterprise Linux 10, Red Hat package: kernel.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Red Hat Linux publishes the next one.
VulniPulse checks Red Hat Linux's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_mutex, and mmap_mutex is per event.
Thus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race rb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows: CPU 0 CPU 1 ===== ===== rb_alloc_aux() map_range() [1]: allocate rb->aux_pages[0] [2]: rb->aux_nr_pages++ [3]: perf_mmap_to_page() returns rb->aux_pages[0] [4]: map it as VM_PFNMAP [5]: rb->aux_pgoff = 1 munmap the page [6]: free rb->aux_pages[0] Pages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a mapping to a freed physical frame.
Fix this by taking rb->aux_mutex across the page walk in map_range(). A use-after-free (UAF) vulnerability exists in the `map_range()` function due to a race condition.
This can occur when two performance events share a ring buffer, allowing a local attacker to map a memory page that has already been freed. Exploiting this flaw could lead to arbitrary code execution or privilege escalation.
Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825.
Affected Red Hat products: Red Hat Enterprise Linux 10.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.
Official advisory · high-confidence parse· fetched 27 days ago·verify at source
- kernel-0:6.12.0-211.47.1.el10_2
- RHSA-2026:54343
Official advisory · high-confidence parse· fetched 27 days ago·verify at source
Mitigation checklist
- Issue introduced in v6.14. Fixed in v6.18.39 with commit c8b7e113f7b61eef2f017e6329c27c2331058c5a, v7.1.4 with commit 0cff05bd2186020f8706233e261016d149cc24db, and v7.2-rc3 with commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c
Official advisory · high-confidence parse· fetched 27 days ago·verify at source
More Red Hat Linux advisories
- CVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-free
- CVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
- CVE-2026-53362Jul 4, 2026account for fraggap on the paged allocation path
- CVE-2026-97229Oct 13, 2026integer overflow issue in CI/CD regular expression compiler
- CVE-2026-64849Aug 17, 2026Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.