CVE-2026-23248

{"id": "CVE-2026-23248", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b709eb872e19a19607bbb6d2975bc264d59735cf", "lessThan": "c27dea9f50ed525facb62ef647dddc4722456e07", "versionType": "git"}, {"status": "affected", "version": "b709eb872e19a19607bbb6d2975bc264d59735cf", "lessThan": "ac7ecb65af170a7fc193e7bd8be15dac84ec6a56", "versionType": "git"}, {"status": "affected", "version": "b709eb872e19a19607bbb6d2975bc264d59735cf", "lessThan": "77de62ad3de3967818c3dbe656b7336ebee461d2", "versionType": "git"}], "programFiles": ["kernel/events/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.17", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.7", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/events/core.c"], "defaultStatus": "affected"}]}], "published": "2026-03-18T11:16:16.863", "references": [{"url": "https://git.kernel.org/stable/c/77de62ad3de3967818c3dbe656b7336ebee461d2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ac7ecb65af170a7fc193e7bd8be15dac84ec6a56", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c27dea9f50ed525facb62ef647dddc4722456e07", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix refcount bug and potential UAF in perf_mmap\n\nSyzkaller reported a refcount_t: addition on 0; use-after-free warning\nin perf_mmap.\n\nThe issue is caused by a race condition between a failing mmap() setup\nand a concurrent mmap() on a dependent event (e.g., using output\nredirection).\n\nIn perf_mmap(), the ring_buffer (rb) is allocated and assigned to\nevent->rb with the mmap_mutex held. The mutex is then released to\nperform map_range().\n\nIf map_range() fails, perf_mmap_close() is called to clean up.\nHowever, since the mutex was dropped, another thread attaching to\nthis event (via inherited events or output redirection) can acquire\nthe mutex, observe the valid event->rb pointer, and attempt to\nincrement its reference count. If the cleanup path has already\ndropped the reference count to zero, this results in a\nuse-after-free or refcount saturation warning.\n\nFix this by extending the scope of mmap_mutex to cover the\nmap_range() call. This ensures that the ring buffer initialization\nand mapping (or cleanup on failure) happens atomically effectively,\npreventing other threads from accessing a half-initialized or\ndying ring buffer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nperf/core: Correcci\u00f3n de error de conteo de referencias y potencial UAF en perf_mmap\n\nSyzkaller inform\u00f3 una advertencia de refcount_t: adici\u00f3n en 0; uso despu\u00e9s de liberaci\u00f3n en perf_mmap.\n\nEl problema es causado por una condici\u00f3n de carrera entre una configuraci\u00f3n de mmap() fallida y un mmap() concurrente en un evento dependiente (por ejemplo, usando redirecci\u00f3n de salida).\n\nEn perf_mmap(), el ring_buffer (rb) se asigna y se establece en event->rb con el mmap_mutex retenido. El mutex es entonces liberado para realizar map_range().\n\nSi map_range() falla, se llama a perf_mmap_close() para limpiar. Sin embargo, dado que el mutex fue liberado, otro hilo que se adjunta a este evento (a trav\u00e9s de eventos heredados o redirecci\u00f3n de salida) puede adquirir el mutex, observar el puntero event->rb v\u00e1lido e intentar incrementar su conteo de referencias. Si la ruta de limpieza ya ha reducido el conteo de referencias a cero, esto resulta en un uso despu\u00e9s de liberaci\u00f3n o una advertencia de saturaci\u00f3n de conteo de referencias.\n\nEsto se corrige al extender el alcance de mmap_mutex para cubrir la llamada a map_range(). Esto asegura que la inicializaci\u00f3n y el mapeo del b\u00fafer de anillo (o la limpieza en caso de fallo) ocurra de manera at\u00f3mica y efectiva, evitando que otros hilos accedan a un b\u00fafer de anillo medio inicializado o en proceso de terminaci\u00f3n."}], "lastModified": "2026-06-17T10:21:11.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E367EC2E-72DB-4555-9BE2-A5B9C97AD4E6", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}