Local privilege escalation via perf mmap race

Use-after-free in Linux kernel 6.18 perf mmap handling allows local users to gain root privileges by racing mmap() with the last munmap(). The perf_mmap_close() path decrements rb->mmap_count without event->mmap_mutex, letting perf_mmap_rb() replace the ring buffer before teardown frees the newly mapped buffer. An unprivileged local user can reach the race with the default kernel.perf_event_paranoid=2 setting; exploitation grants root access.