CVE-2026-98116 is a vulnerability in Linux Kernel
Published on September 25, 2026
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation
with an mmap_count check performed under the PCM stream lock, but the
lock is released long before the buffer is actually freed:
snd_pcm_sync_stop(), constraint refinement and do_free_pages() all
happen in between. snd_pcm_mmap_data(), on the other hand, takes no
lock at all: it validates against the old buffer's state and
dma_bytes, remaps its pages into the VMA, and only then increments
mmap_count.
A concurrent mmap() can therefore slip in between the check and the
free. remap_pfn_range() installs writable PTEs for the old buffer's
pages without taking page references, and the subsequent
do_free_pages() returns those pages to the page allocator while the
VMA still maps them. This leaves a stale, writable mapping of freed
pages: a page-level use-after-free that can be leveraged for local
privilege escalation.
Make snd_pcm_mmap_data() participate in the buffer-access scheme
introduced for hw_params/hw_free: acquire runtime->buffer_accessing
before validating and remapping, and release it afterwards. Buffer
reallocation already fails with -EBUSY while accessors are active,
and the mmap side now fails with -EBUSY while a reallocation is in
progress, so the validate/remap sequence and the check/free sequence
can no longer interleave.
A reproducer that turns this race into a stale writable mapping of
the freed DMA buffer pages is available on request.
Products Associated with CVE-2026-98116
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 92ee3c60ec9fe64404dc035e7c41277d74aa26cb and below cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5 is affected.
- Version 92ee3c60ec9fe64404dc035e7c41277d74aa26cb and below fd137bf8149bc6460f9b7b1fc292025da04cb9ee is affected.
- Version 92ee3c60ec9fe64404dc035e7c41277d74aa26cb and below 8c1882dfee8f404d118020664b73eb4592172226 is affected.
- Version 92ee3c60ec9fe64404dc035e7c41277d74aa26cb and below 9b110a9dcecc59516c77cb3c0caf1f492f75df2d is affected.
- Version a42aa926843acca96c0dfbde2e835b8137f2f092 is affected.
- Version 9cb6c40a6ebe4a0cfc9d6a181958211682cffea9 is affected.
- Version fbeb492694ce0441053de57699e1e2b7bc148a69 is affected.
- Version 0f6947f5f5208f6ebd4d76a82a4757e2839a23f8 is affected.
- Version 33061d0fba51d2bf70a2ef9645f703c33fe8e438 is affected.
- Version 0090c13cbbdffd7da079ac56f80373a9a1be0bf8 is affected.
- Version 1bbf82d9f961414d6c76a08f7f843ea068e0ab7b is affected.
- Version 4.14.279 and below 4.15 is affected.
- Version 4.19.243 and below 4.20 is affected.
- Version 5.4.193 and below 5.5 is affected.
- Version 5.10.109 and below 5.11 is affected.
- Version 5.15.32 and below 5.16 is affected.
- Version 5.16.18 and below 5.17 is affected.
- Version 5.17.1 and below 5.18 is affected.
- Version 5.18 is affected.
- Before 5.18 is unaffected.
- Version 6.12.111, <= 6.12.* is unaffected.
- Version 6.18.53, <= 6.18.* is unaffected.
- Version 7.2.7, <= 7.2.* is unaffected.
- Version 7.3-rc2, <= * is unaffected.