# CVE-2026-64300 — Linux

> As of 2026-11-11, CVE-2026-64300 is a HIGH-severity vulnerability in Linux, CVSS v3.1 7.8, EPSS 0.1% (7.1th percentile). Threadlinqs Intelligence links 2 tracked threat campaigns to CVE-2026-64300, most recently “Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit”.

**Last updated:** 2026-11-11

## What is CVE-2026-64300?

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in map_range() map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are serialized by rb->aux_mutex, and mmap_mutex is per event. Thus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race rb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows: CPU 0 CPU 1 ===== ===== rb_alloc_aux() map_range() [1]: allocate rb->aux_pages[0] [2]: rb->aux_nr_pages++ [3]: perf_mmap_to_page() returns rb->aux_pages[0] [4]: map it as VM_PFNMAP [5]: rb->aux_pgoff = 1 munmap the page [6]: free rb->aux_pages[0] Pages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a mapping to a freed physical frame. Fix this by taking rb->aux_mutex across the page walk in map_range().

The record classifies CVE-2026-64300 under weakness class [CWE-416](https://intel.threadlinqs.com/cwe/CWE-416). Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 109 days ago.

## Severity and exploitation probability

- **CVSS v3.1 base score:** 7.8 — HIGH (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **EPSS (FIRST):** 0.1% probability of exploitation in the next 30 days, higher than 7.1% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 4.2/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2026-07-25

## Is CVE-2026-64300 being exploited?

It currently carries a trending score of 23 in the Threadlinqs vulnerability feed.

## Affected products and versions

- [Linux](https://intel.threadlinqs.com/vendors/linux): Linux

## How to fix CVE-2026-64300

The record marks a vendor fix as available for CVE-2026-64300. Patch reference: [https://git.kernel.org/stable/c/0cff05bd2186020f8706233e261016d149cc24db](https://git.kernel.org/stable/c/0cff05bd2186020f8706233e261016d149cc24db). Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

## Threat activity tracking CVE-2026-64300

2 tracked threats in the Threadlinqs corpus reference CVE-2026-64300, either in the campaign’s CVE list or as an indicator on the campaign record.

- [Linux kernel net/sched action-IDR use-after-free LPE (CVE-2026-53264) and perf/aux page-UAF LPE (CVE-2026-64300) with public exploit](https://intel.threadlinqs.com/threat/TL-2026-5729) — HIGH · 2026-11-11
- [CVE-2026-53264: AI-Assisted Discovery of Linux Kernel net/sched Use-After-Free Enabling Local Root Privilege Escalation](https://intel.threadlinqs.com/threat/TL-2026-1744) — HIGH · 2026-07-28

## Sources

Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories. This product uses the NVD API but is not endorsed or certified by the NVD.

**Other references**

- [git.kernel.org](https://git.kernel.org/stable/c/c8b7e113f7b61eef2f017e6329c27c2331058c5a)
- [git.kernel.org (0cff05bd2186020f8706233e261016d149cc24db)](https://git.kernel.org/stable/c/0cff05bd2186020f8706233e261016d149cc24db)
- [git.kernel.org (5948aaf64f81f217a25dcc2bf6c0779bca19566c)](https://git.kernel.org/stable/c/5948aaf64f81f217a25dcc2bf6c0779bca19566c)

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-64300
Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Sign up free (Blue): https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds (https://threadlinqs.com/tl-creds); MCP access for AI agents needs Purple: https://intel.threadlinqs.com/mcp