Linux Kernel EUVD-2026-86205

Requires local access and the ability to create perf events with address filter ranges via perf_event_open (the addr_filter_ranges structure is only allocated/used when hardware/address-filter tracing is configured). Exploitation is gated by CAP_PERFMON and the kernel.perf_event_paranoid sysctl, which on many hardened systems and container runtimes blocks unprivileged perf access entirely. Because the bug is a UAF race between event teardown and an RCU reader, triggering it reliably needs precise timing, and impact beyond a kernel crash requires additional heap manipulation not present by default.

This is a use-after-free (functionally CWE-416; NVD lists CWE as N/A) in the Linux kernel perf events core, where event::addr_filter_ranges was accessed under RCU but freed without an RCU grace period. The NVD CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this as a full local privilege-escalation-class memory-corruption bug with easy exploitation, but that likely overstates real-world risk. It is a lifetime/race condition rather than an attacker-directed write primitive, and reaching addr_filter_ranges requires the ability to create perf events with address filters (perf_event_open, gated by CAP_PERFMON and the perf_event_paranoid sysctl, which is restricted in many hardened/container environments). No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Realistically this is crash-dominant (DoS via UAF) with a theoretical path to info leak or corruption; I assess it closer to ~5.3 (AV:L/AC:H/PR:L/C:L/I:N/A:H). It is a legitimate bug to patch on kernels exposing perf to unprivileged users, but not an urgent high-priority remote threat. Note the AC:L in the NVD vector conflicts with the race-based nature of the flaw, which favors AC:H - verify against the commit.

A local user with permission to call perf_event_open and configure address filters (e.g., where perf_event_paranoid is permissive) races event teardown against an RCU reader of addr_filter_ranges, dereferencing freed memory. In practice this most reliably yields a kernel crash (DoS); leveraging the UAF into information disclosure or privilege escalation would require significant additional heap-grooming and is not demonstrated. No public proof-of-concept is referenced.