In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM...

zetlyn/cve-ghsa vulnerability ghsa GHSA-pwf2-cf6j-p6wx cve CVE-2026-98116 known 2026-09-25

https://github.com/advisories/GHSA-pwf2-cf6j-p6wx

Properties

cvss

cvss	7.8 receipt Source GitHub advisories Its words `7.8` Read by `field:cvss.score` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 12:22 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-98116", "cvss": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_severities": { "cvss_v3": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_v4": { "score": 0.0, "vector_string": null } }, "cwes": [], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n\nsnd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation\nwith an mmap_count check performed under the PCM stream lock, but the\nlock is released long before the buffer is actually freed:\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all\nhappen in between. snd_pcm_mmap_data(), on the other hand, takes no\nlock at all: it validates against the old buffer's state and\ndma_bytes, remaps its pages into the VMA, and only then increments\nmmap_count.\n\nA concurrent mmap() can therefore slip in between the check and the\nfree. remap_pfn_range() installs writable PTEs for the old buffer's\npages without taking page references, and the subsequent\ndo_free_pages() returns those pages to the page allocator while the\nVMA still maps them. This leaves a stale, writable mapping of freed\npages: a page-level use-after-free that can be leveraged for local\nprivilege escalation.\n\nMake snd_pcm_mmap_data() participate in the buffer-access scheme\nintroduced for hw_params/hw_free: acquire runtime->buffer_accessing\nbefore validating and remapping, and release it afterwards. Buffer\nreallocation already fails with -EBUSY while accessors are active,\nand the mmap side now fails with -EBUSY while a reallocation is in\nprogress, so the validate/remap sequence and the check/free sequence\ncan no longer interleave.\n\nA reproducer that turns this race into a stale writable mapping of\nthe freed DMA buffer pages is available on request.", "epss": { "percentage": 0.00125, "percentile": 0.01915 }, "ghsa_id": "GHSA-pwf2-cf6j-p6wx", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-pwf2-cf6j-p6wx", "identifiers": [ { "type": "GHSA", "value": "GHSA-pwf2-cf6j-p6wx" }, { "type": "CVE", "value": "CVE-2026-98116" } ], "nvd_published_at": "2026-09-25T11:17:42Z", "published_at": "2026-09-25T12:31:37Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-98116", "https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226", "https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d", "https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5", "https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee", "https://github.com/advisories/GHSA-pwf2-cf6j-p6wx" ], "repository_advisory_url": null, "severity": "high", "source_code_location": "", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM...", "type": "unreviewed", "updated_at": "2026-09-25T15:32:52Z", "url": "https://api.github.com/advisories/GHSA-pwf2-cf6j-p6wx", "vulnerabilities": [], "withdrawn_at": null }
severity	high From 7.0 to 8.9. receipt Source GitHub advisories Its words `high` Read by `field:severity` Said since 2026-09-28 11:44 UTC Last answered 2026-10-05 12:22 UTC Original open at the source What the source handed over { "credits": [], "cve_id": "CVE-2026-98116", "cvss": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_severities": { "cvss_v3": { "score": 7.8, "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "cvss_v4": { "score": 0.0, "vector_string": null } }, "cwes": [], "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n\nsnd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation\nwith an mmap_count check performed under the PCM stream lock, but the\nlock is released long before the buffer is actually freed:\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all\nhappen in between. snd_pcm_mmap_data(), on the other hand, takes no\nlock at all: it validates against the old buffer's state and\ndma_bytes, remaps its pages into the VMA, and only then increments\nmmap_count.\n\nA concurrent mmap() can therefore slip in between the check and the\nfree. remap_pfn_range() installs writable PTEs for the old buffer's\npages without taking page references, and the subsequent\ndo_free_pages() returns those pages to the page allocator while the\nVMA still maps them. This leaves a stale, writable mapping of freed\npages: a page-level use-after-free that can be leveraged for local\nprivilege escalation.\n\nMake snd_pcm_mmap_data() participate in the buffer-access scheme\nintroduced for hw_params/hw_free: acquire runtime->buffer_accessing\nbefore validating and remapping, and release it afterwards. Buffer\nreallocation already fails with -EBUSY while accessors are active,\nand the mmap side now fails with -EBUSY while a reallocation is in\nprogress, so the validate/remap sequence and the check/free sequence\ncan no longer interleave.\n\nA reproducer that turns this race into a stale writable mapping of\nthe freed DMA buffer pages is available on request.", "epss": { "percentage": 0.00125, "percentile": 0.01915 }, "ghsa_id": "GHSA-pwf2-cf6j-p6wx", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-pwf2-cf6j-p6wx", "identifiers": [ { "type": "GHSA", "value": "GHSA-pwf2-cf6j-p6wx" }, { "type": "CVE", "value": "CVE-2026-98116" } ], "nvd_published_at": "2026-09-25T11:17:42Z", "published_at": "2026-09-25T12:31:37Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-98116", "https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226", "https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d", "https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5", "https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee", "https://github.com/advisories/GHSA-pwf2-cf6j-p6wx" ], "repository_advisory_url": null, "severity": "high", "source_code_location": "", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM...", "type": "unreviewed", "updated_at": "2026-09-25T15:32:52Z", "url": "https://api.github.com/advisories/GHSA-pwf2-cf6j-p6wx", "vulnerabilities": [], "withdrawn_at": null }

7.8

receipt

Source: GitHub advisories
Its words: 7.8
Read by: field:cvss.score
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-05 12:22 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-98116",
  "cvss": {
    "score": 7.8,
    "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.8,
      "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [],
  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n\nsnd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation\nwith an mmap_count check performed under the PCM stream lock, but the\nlock is released long before the buffer is actually freed:\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all\nhappen in between.  snd_pcm_mmap_data(), on the other hand, takes no\nlock at all: it validates against the old buffer's state and\ndma_bytes, remaps its pages into the VMA, and only then increments\nmmap_count.\n\nA concurrent mmap() can therefore slip in between the check and the\nfree.  remap_pfn_range() installs writable PTEs for the old buffer's\npages without taking page references, and the subsequent\ndo_free_pages() returns those pages to the page allocator while the\nVMA still maps them.  This leaves a stale, writable mapping of freed\npages: a page-level use-after-free that can be leveraged for local\nprivilege escalation.\n\nMake snd_pcm_mmap_data() participate in the buffer-access scheme\nintroduced for hw_params/hw_free: acquire runtime->buffer_accessing\nbefore validating and remapping, and release it afterwards.  Buffer\nreallocation already fails with -EBUSY while accessors are active,\nand the mmap side now fails with -EBUSY while a reallocation is in\nprogress, so the validate/remap sequence and the check/free sequence\ncan no longer interleave.\n\nA reproducer that turns this race into a stale writable mapping of\nthe freed DMA buffer pages is available on request.",
  "epss": {
    "percentage": 0.00125,
    "percentile": 0.01915
  },
  "ghsa_id": "GHSA-pwf2-cf6j-p6wx",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-pwf2-cf6j-p6wx",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-pwf2-cf6j-p6wx"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-98116"
    }
  ],
  "nvd_published_at": "2026-09-25T11:17:42Z",
  "published_at": "2026-09-25T12:31:37Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-98116",
    "https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226",
    "https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d",
    "https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5",
    "https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee",
    "https://github.com/advisories/GHSA-pwf2-cf6j-p6wx"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM...",
  "type": "unreviewed",
  "updated_at": "2026-09-25T15:32:52Z",
  "url": "https://api.github.com/advisories/GHSA-pwf2-cf6j-p6wx",
  "vulnerabilities": [],
  "withdrawn_at": null
}

severity

high

From 7.0 to 8.9.

receipt

Source: GitHub advisories
Its words: high
Read by: field:severity
Said since: 2026-09-28 11:44 UTC
Last answered: 2026-10-05 12:22 UTC
Original: open at the source

What the source handed over

{
  "credits": [],
  "cve_id": "CVE-2026-98116",
  "cvss": {
    "score": 7.8,
    "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.8,
      "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    },
    "cvss_v4": {
      "score": 0.0,
      "vector_string": null
    }
  },
  "cwes": [],
  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n\nsnd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation\nwith an mmap_count check performed under the PCM stream lock, but the\nlock is released long before the buffer is actually freed:\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all\nhappen in between.  snd_pcm_mmap_data(), on the other hand, takes no\nlock at all: it validates against the old buffer's state and\ndma_bytes, remaps its pages into the VMA, and only then increments\nmmap_count.\n\nA concurrent mmap() can therefore slip in between the check and the\nfree.  remap_pfn_range() installs writable PTEs for the old buffer's\npages without taking page references, and the subsequent\ndo_free_pages() returns those pages to the page allocator while the\nVMA still maps them.  This leaves a stale, writable mapping of freed\npages: a page-level use-after-free that can be leveraged for local\nprivilege escalation.\n\nMake snd_pcm_mmap_data() participate in the buffer-access scheme\nintroduced for hw_params/hw_free: acquire runtime->buffer_accessing\nbefore validating and remapping, and release it afterwards.  Buffer\nreallocation already fails with -EBUSY while accessors are active,\nand the mmap side now fails with -EBUSY while a reallocation is in\nprogress, so the validate/remap sequence and the check/free sequence\ncan no longer interleave.\n\nA reproducer that turns this race into a stale writable mapping of\nthe freed DMA buffer pages is available on request.",
  "epss": {
    "percentage": 0.00125,
    "percentile": 0.01915
  },
  "ghsa_id": "GHSA-pwf2-cf6j-p6wx",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-pwf2-cf6j-p6wx",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-pwf2-cf6j-p6wx"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-98116"
    }
  ],
  "nvd_published_at": "2026-09-25T11:17:42Z",
  "published_at": "2026-09-25T12:31:37Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-98116",
    "https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226",
    "https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d",
    "https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5",
    "https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee",
    "https://github.com/advisories/GHSA-pwf2-cf6j-p6wx"
  ],
  "repository_advisory_url": null,
  "severity": "high",
  "source_code_location": "",
  "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM...",
  "type": "unreviewed",
  "updated_at": "2026-09-25T15:32:52Z",
  "url": "https://api.github.com/advisories/GHSA-pwf2-cf6j-p6wx",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM... In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM stream lock, but the lock is released long before the buffer is actually freed: snd_pcm_sync_stop(), constraint refinement and do_free_pages() all happen in between. snd_pcm_mmap_data(), on the other hand, takes no lock at all: it validates against the old buffer's state and dma_bytes, remaps its pages into the VMA, and only then increments mmap_count. A concurrent mmap() can therefore slip in between the check and the free. remap_pfn_range() installs writable PTEs for the old buffer's pages without taking page references, and the subsequent do_free_pages() returns those pages to the page allocator while the VMA still maps them. This leaves a stale, writable mapping of freed pages: a page-level use-after-free that can be leveraged for local privilege escalation. Make snd_pcm_mmap_data() participate in the buffer-access scheme introduced for hw_params/hw_free: acquire runtime->buffer_accessing before validating and remapping, and release it afterwards. Buffer reallocation already fails with -EBUSY while accessors are active, and the mmap side now fails with -EBUSY while a reallocation is in progress, so the validate/remap sequence and the check/free sequence can no longer interleave. A reproducer that turns this race into a stale writable mapping of the freed DMA buffer pages is available on request.