The Linux kernel’s perf subsystem has a race condition between its mmap and munmap operations. A concurrent reviving mmap call can overlap with the final munmap of a ring buffer. The resulting use‑after‑free frees a buffer while another process still has it mapped, allowing a local user to access freed kernel memory that can be manipulated to gain root privileges, especially when perf_event_paranoid is set to 2.

This flaw affects all Linux kernel releases that include the perf subsystem prior to the commit that reordered the reference‑count updates. Affected versions are not enumerated by the CNA, but any mainline kernel that has not yet applied the described patch is potentially impacted.

The EPSS score is reported as less than 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The absence of a public CVSS score means the severity cannot be quantified, yet the nature of the bug—a local use‑after‑free that can lead to privilege escalation—merits high risk. Exploitation requires a local, unprivileged process to coordinate concurrent mmap and munmap calls and is most likely to be carried out from a compromised user account.