Linux Kernel EUVD-2026-49012

The Linux kernel Performance Events subsystem (perf) supports AUX ring buffers for hardware trace data (e.g., Intel PT, ARM CoreSight). When a ring buffer is shared between two events via the PERF_EVENT_IOC_SET_OUTPUT ioctl, map_range() on one event can concurrently execute with rb_alloc_aux() on another. The ring buffer fields rb->aux_pages[], rb->aux_nr_pages, and rb->aux_pgoff are protected by rb->aux_mutex, but map_range() acquires only the per-event event->mmap_mutex, creating a TOCTOU window. Pages installed into the VMA as VM_PFNMAP carry no page-struct refcount protection, so if rb_alloc_aux() allocates and then frees a page (e.g., via munmap) while map_range() has already retrieved a pointer to that page from rb->aux_pages[], the VMA retains a dangling mapping to the freed physical frame - a classic CWE-416 Use-After-Free at the page-table level. The fix serialises the page walk in map_range() under rb->aux_mutex. Affected CPE: cpe:2.3:a:linux:linux.