Linux Kernel CVE-2026-89791

Requires local access as an unprivileged user; no user interaction or elevated privileges are needed beyond a normal local account because the perf mmap/munmap path is reachable under the default kernel.perf_event_paranoid=2 setting. The core prerequisite is winning a tight TOCTOU race: perf_mmap_close() decrements rb->mmap_count outside event->mmap_mutex, and the attacker must land a concurrent perf_mmap_rb() revival (rb_alloc + refcount_set(&event->mmap_count,1)) inside that unlocked window. Limiting factors: exploitation is probabilistic and timing-sensitive (repeated attempts needed), it is local-only (not remotely reachable), and it is neutralized on kernels patched to 6.18.52 / 7.2.5 / 7.3-rc2 or later stable trees carrying the counter-order fix.

This is a genuine local privilege-escalation vulnerability in the Linux kernel perf subsystem, and the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) correctly captures a full-triad memory-corruption impact reachable by an unprivileged local user. The exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no POC in the provided sources, and the low EPSS (0.19%, 9th percentile) reflects the absence of observed weaponization rather than a low technical impact. One signal is worth flagging: the vendor rates AC:L, but the flaw is fundamentally a narrow TOCTOU race - perf_mmap_close() must drop rb->mmap_count in the exact unlocked window before a concurrent perf_mmap_rb() revival completes its refcount_set - which in practice requires precise timing and repeated attempts, so I independently assess AC:H (CVSS 4.0 AT:P). This lowers realized exploitability somewhat but does not change the severity of a successful exploit (root via page-level UAF). Net: a real prioritization candidate for multi-tenant/shared Linux hosts because it needs only unprivileged local access under the default kernel.perf_event_paranoid=2, tempered by the race-window difficulty and current lack of public exploit code.

An unprivileged local user on a default-configured Linux host (kernel.perf_event_paranoid=2) opens a perf event, then races a thread performing mmap() 'revival' against another thread performing the final munmap() so that perf_mmap_close() frees a ring buffer that the revival path has just re-attached and that is still mapped. Winning the race yields a page-level use-after-free, which can be groomed into arbitrary kernel read/write and escalation to root. No public exploit code is currently identified; the attack requires precise timing to hit the unlocked refcount-decrement window (AC:H).