The Linux kernel perf subsystem had a race condition in map_range() where rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff were accessed under event->mmap_mutex but not under rb->aux_mutex, which serializes these fields. Two events sharing a ring buffer via PERF_EVENT_IOC_SET_OUTPUT could race between rb_alloc_aux() and map_range(), causing a page to be freed while still mapped as VM_PFNMAP. Since VM_PFNMAP pages lack reference count protection, this leads to a use-after-free of a physical page. The fix involves taking rb->aux_mutex during the page walk in map_range() to prevent this race.

This vulnerability allows a use-after-free condition on a physical page mapped in user space, which can lead to memory corruption or potential privilege escalation if exploited. However, no known exploits are reported in the wild at this time.

A fix has been applied to the Linux kernel by introducing proper locking with rb->aux_mutex in map_range(). Users should update to a kernel version that includes this fix once available. Patch status is not yet confirmed from the vendor advisory; check the official Linux kernel advisories or distribution updates for the fixed versions.