Linux Kernel Perf Use-After-Free in Shared Ring Buffer

CVE-2026-64300 is a use-after-free (UAF) vulnerability in the Linux kernel's performance monitoring (perf) subsystem that affects the auxiliary ring buffer (aux) handling. The vulnerability arises from a race condition in the map_range() function when multiple performance events share the same ring buffer through PERF_EVENT_IOC_SET_OUTPUT. The issue occurs because map_range() accesses shared ring buffer fields (aux_pages[], aux_nr_pages, and aux_pgoff) while holding only a per-event mutex, while these fields are actually protected by a different mutex (aux_mutex) at the ring buffer level. This synchronization mismatch allows two events to race, with one event reallocating the auxiliary pages while another is still mapping them, resulting in a page use-after-free condition. This vulnerability affects any Linux system running vulnerable kernel versions where users can create and manipulate performance monitoring events, potentially allowing local privilege escalation or denial of service.

Casky.ai's Claude-powered analysis would identify this vulnerability through detection of memory safety violations and synchronization bypass patterns, even without explicit MITRE ATT&CK mappings. The platform's 754 security skills would flag suspicious perf subsystem activity including: (1) abnormal patterns in perf_event_open() syscall sequences with shared ring buffers, (2) timing-based anomalies in rapid PERF_EVENT_IOC_SET_OUTPUT calls followed by memory access, and (3) system behaviors consistent with use-after-free exploitation such as kernel memory corruption or unexpected crashes in perf-related operations. Extended reasoning capabilities would correlate low-level kernel synchronization failures with potential Privilege Escalation and Resource Exhaustion attack patterns, helping practitioners identify exploitation attempts even when attackers attempt to obfuscate the underlying race condition.