CVE-2026-23127

In the Linux kernel, the following vulnerability has been resolved: perf: Fix refcount warning on event->mmap_count increment When calling refcount_inc(&event->mmap_count) inside perf_mmap_rb(), the following warning is triggered: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 PoC: struct perf_event_attr attr = {0}; int fd = syscall(__NR_perf_event_open, &attr, 0, -1, -1, 0); mmap(NULL, 0x3000, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); int victim = syscall(__NR_perf_event_open, &attr, 0, -1, fd, PERF_FLAG_FD_OUTPUT); mmap(NULL, 0x3000, PROT_READ | PROT_WRITE, MAP_SHARED, victim, 0); This occurs when creating a group member event with the flag PERF_FLAG_FD_OUTPUT. The group leader should be mmap-ed and then mmap-ing the event triggers the warning. Since the event has copied the output_event in perf_event_set_output(), event->rb is set. As a result, perf_mmap_rb() calls refcount_inc(&event->mmap_count) when event->mmap_count = 0. Disallow the case when event->mmap_count = 0. This also prevents two events from updating the same user_page.

• https://git.kernel.org/stable/c/23c0e4bd93d0b250775162faf456470485ac9fc7Patch
• https://git.kernel.org/stable/c/d06bf78e55d5159c1b00072e606ab924ffbbad35Patch

Published

Feb 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23121In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23122In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23123In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23124In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23125In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23126In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2026-23128In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23129In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-2313Use after free in CSS in Google Chrome prior to 145.0.7632.4…8.8
• CVE-2026-23130In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23131In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-23132In the Linux kernel, the following vulnerability has been re…5.5