The vulnerability (CVE-2026-64300) in the Linux kernel perf subsystem involves a use-after-free condition in the map_range() function. The issue stems from map_range() reading rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff under event->mmap_mutex, while these fields are serialized by rb->aux_mutex. Because mmap_mutex is per event, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race rb_alloc_aux() with map_range(), leading to a page being freed while still mapped as VM_PFNMAP. Pages mapped this way lack reference count protection, resulting in a use-after-free scenario. This vulnerability was fixed in updated linux-hwe-edge kernel versions as part of broader Linux kernel security updates.

This vulnerability allows a local attacker to trigger a use-after-free condition in kernel memory, potentially leading to arbitrary code execution, privilege escalation, or system compromise due to the mapping of freed physical pages without proper reference counting. The CVSS score of 7.8 (high) reflects the significant confidentiality, integrity, and availability impacts possible if exploited.

A patch is available and should be applied by updating to the fixed linux-hwe-edge kernel versions as specified in the Ubuntu security advisories (USN-8726-1 and USN-8727-1). After updating, a system reboot is required. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow vendor instructions for updating to the fixed package versions to fully mitigate this vulnerability.