CVE-2026-89791 Overview
CVE-2026-89791 is a use-after-free vulnerability in the Linux kernel's performance events (perf) subsystem. The flaw exists in perf_mmap_close(), which decrements rb->mmap_count without holding event->mmap_mutex. A concurrent perf_mmap() call can slot an entire ring buffer revival path into that unlocked window, causing the close path to free a ring buffer that another process still has mapped.
The resulting page-level use-after-free enables local privilege escalation to root by any unprivileged user under the default kernel.perf_event_paranoid=2 setting.
Critical Impact
Any unprivileged local user can trigger the race to achieve root privilege escalation on affected Linux kernels using default perf_event_paranoid settings.
Affected Products
- Linux kernel perf subsystem (upstream)
- Distributions shipping affected stable kernel branches referenced in the fix commits
- Systems with default kernel.perf_event_paranoid=2 where unprivileged users can call perf_event_open() on their own processes
Discovery Timeline
- 2026-09-16 - CVE-2026-89791 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89791
Vulnerability Analysis
The Linux kernel perf subsystem uses two reference counters to manage ring buffer lifetime: event->mmap_count and rb->mmap_count. The teardown path in perf_mmap_close() decrements rb->mmap_count using refcount_dec_and_test() before acquiring event->mmap_mutex through refcount_dec_and_mutex_lock() on event->mmap_count.
This ordering creates a window where a concurrent perf_mmap() call, which holds event->mmap_mutex for its entire duration including rb_alloc(), can execute a full ring buffer revival. The revival calls ring_buffer_attach(event, NULL), allocates a new ring buffer, and executes refcount_set(&event->mmap_count, 1). This last write is invisible to the close path because it represents a 1 → 1 transition.
When the close path finally acquires the mutex and observes event->mmap_count drop from 1 to 0, it detaches and releases the newly allocated ring buffer while the other process still has it mapped. Subsequent access to the freed pages yields a use-after-free condition [CWE-416].
Root Cause
The root cause is a race condition between reference counter updates that are not serialized under a common lock. The refcount_set() call in the revival path masks the true state transition from the close path. The fix reorders the two counter updates so that event->mmap_count is dropped first via refcount_dec_and_mutex_lock(), keeping the 1 → 0 transition and the associated ring_buffer_attach() serialized with perf_mmap().
Attack Vector
Exploitation requires local code execution as an unprivileged user. An attacker creates a perf event, maps its ring buffer, and races munmap() against a second thread performing mmap() on the same event. Winning the race causes the kernel to free a ring buffer that remains mapped in user address space. The attacker then manipulates freed page contents to corrupt kernel state and escalate to root. See the upstream kernel fix commit for technical details on the corrected locking order.
Detection Methods for CVE-2026-89791
Indicators of Compromise
- Unexpected kernel oops or BUG: KASAN: use-after-free entries referencing perf_mmap_close or ring_buffer_put in dmesg
- Unprivileged processes making high-frequency perf_event_open(), mmap(), and munmap() syscalls against the same file descriptor
- Unexplained root shells or SUID process spawns from user sessions shortly after heavy perf activity
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) in test environments to surface use-after-free conditions in the perf subsystem
- Audit perf_event_open syscall usage with eBPF or auditd rules to flag unprivileged callers issuing rapid mmap/munmap cycles
- Correlate kernel crash telemetry with process ancestry to identify exploitation attempts against perf_mmap_close
Monitoring Recommendations
- Monitor /proc/sys/kernel/perf_event_paranoid for downgrades below the distribution default
- Alert on kernel taint flags and oops events referencing perf ring buffer teardown paths
- Track process privilege transitions from unprivileged UIDs to UID 0 without an authorized setuid binary in the ancestry
How to Mitigate CVE-2026-89791
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits 0c739f54f1c7, 58a8108bc73d, and 929cb3b9dc81
- Raise kernel.perf_event_paranoid to 3 where supported, restricting perf_event_open() to CAP_PERFMON or CAP_SYS_ADMIN holders
- Inventory systems running affected stable kernel branches and prioritize multi-tenant hosts, container hosts, and shared workstations
Patch Information
The fix reorders reference counter updates in perf_mmap_close() so that event->mmap_count drops first under event->mmap_mutex, serializing the teardown against any concurrent perf_mmap() revival. Stable tree commits are available at kernel.org commit 929cb3b9, kernel.org commit 58a8108b, and kernel.org commit 0c739f54. Rebuild and reboot affected kernels after applying the fix.
Workarounds
- Set kernel.perf_event_paranoid=3 via sysctl to block unprivileged access to perf_event_open() until patches are deployed
- Restrict container and sandbox profiles to drop CAP_PERFMON and CAP_SYS_ADMIN for untrusted workloads
- Use seccomp filters to deny the perf_event_open syscall for processes that do not require performance instrumentation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
