Skip to content
Heist/ feed
High

ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM stream lock, but the lock is released long before the buffer is actually freed: snd_pcm_sync_stop(), constraint refinement and do_free_pages() all happen in between. snd_pcm_mmap_data(), on the other hand, takes no lock at all: it validates against the old buffer's state and dma_bytes, remaps its pages into the VMA, and only then increments mmap_count. A concurrent mmap() can therefore slip in between the check and the free. remap_pfn_range() installs writable PTEs for the old buffer's pages without taking page references, and the subsequent do_free_pages() returns those pages to the page allocator while the VMA still maps them. This leaves a stale, writable mapping of freed pages: a page-level use-after-free that can be leveraged for local privilege escalation. Make snd_pcm_mmap_data() participate in the buffer-access scheme introduced for hw_params/hw_free: acquire runtime->buffer_accessing before validating and remapping, and release it afterwards. Buffer reallocation already fails with -EBUSY while accessors are active, and the mmap side now fails with -EBUSY while a reallocation is in progress, so the validate/remap sequence and the check/free sequence can no longer interleave. A reproducer that turns this race into a s

Announced Source revision 1
Original source ↗

CVE-2026-98116

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-98116

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "33061d0fba51d2bf70a2ef9645f703c33fe8e438",
        "lessThan": "e6cdd2a0470d64073349a970dc1691433804b271",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
        "lessThan": "9857a75714bb5df4781e4d8b1a1753b1e17bf07a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
        "lessThan": "cbadf2575d25e7dcc0d4da2717817ae569fbc99b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
        "lessThan": "cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
        "lessThan": "fd137bf8149bc6460f9b7b1fc292025da04cb9ee",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
        "lessThan": "8c1882dfee8f404d118020664b73eb4592172226",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "92ee3c60ec9fe64404dc035e7c41277d74aa26cb",
        "lessThan": "9b110a9dcecc59516c77cb3c0caf1f492f75df2d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "a42aa926843acca96c0dfbde2e835b8137f2f092",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9cb6c40a6ebe4a0cfc9d6a181958211682cffea9",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fbeb492694ce0441053de57699e1e2b7bc148a69",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0f6947f5f5208f6ebd4d76a82a4757e2839a23f8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0090c13cbbdffd7da079ac56f80373a9a1be0bf8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "1bbf82d9f961414d6c76a08f7f843ea068e0ab7b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5.15.32",
        "lessThan": "5.15.222",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.14.279",
        "lessThan": "4.15",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.19.243",
        "lessThan": "4.20",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "5.4.193",
        "lessThan": "5.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "5.10.109",
        "lessThan": "5.11",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "5.16.18",
        "lessThan": "5.17",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "5.17.1",
        "lessThan": "5.18",
        "versionType": "semver"
      }
    ],
    "programFiles": [
      "sound/core/pcm_native.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.18"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.18",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.222",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.189",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.158",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.111",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.53",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.7",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "sound/core/pcm_native.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-98116

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#38215 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement