An unprotected use‑after‑free race condition exists in the Linux kernel’s perf/aux subsystem. The map_range() helper reads auxiliary page information from a ring buffer without holding the rb->aux_mutex mutex, which protects the aux_pages array, aux_nr_pages and aux_pgoff. If two perf events share a ring buffer through PERF_EVENT_IOC_SET_OUTPUT, one event can allocate a new aux page while the other concurrently maps it. The mapping is performed as VM_PFNMAP, which carries no reference counting; if the page is freed before the mapping is released, the kernel holds a mapping to memory that has been released. This situation may allow a local attacker to manipulate the freed memory and potentially execute arbitrary kernel code, resulting in privilege escalation.

Any Linux kernel that has not incorporated the fix for the map_range() race condition. All mainstream releases that were built before the integration of commit c8b7e113f7b61eef2f017e6329c27c2331058c5a are considered affected; this includes many kernels across all major distributions until the update is applied.

The CVSS score of 7.8 indicates a fairly high severity, while the EPSS score of less than 1% reflects a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV, suggesting no publicly confirmed exploits are known. The likely attack vector is local; an attacker with the ability to open perf events and invoke PERF_EVENT_IOC_SET_OUTPUT on a shared ring buffer can trigger the race. Although the exploitation effort is non‑trivial, the potential for arbitrary kernel code execution warrants vigilant mitigation.