Strix
65K

CVE-2026-98116

HIGHCVSS 7.8/10

Last modified

CVE-2026-98116 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM stream lock, but the lock is released long before the buffer is actually freed: snd_pcm_sync_stop(), constraint refinement and do_free_pages() all happen in between. snd_pcm_mmap_data(), on the other hand, takes no lock at all: it validates against the old buffer's state and dma_bytes, remaps its pages into the VMA, and only then increments mmap_count. A concurrent mmap() can therefore slip in between the check and the free.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM stream lock, but the lock is released long before the buffer is actually freed: snd_pcm_sync_stop(), constraint refinement and do_free_pages() all happen in between. snd_pcm_mmap_data(), on the other hand, takes no lock at all: it validates against the old buffer's state and dma_bytes, remaps its pages into the VMA, and only then increments mmap_count. A concurrent mmap() can therefore slip in between the check and the free. remap_pfn_range() installs writable PTEs for the old buffer's pages without taking page references, and the subsequent do_free_pages() returns those pages to the page allocator while the VMA still maps them. This leaves a stale, writable mapping of freed pages: a page-level use-after-free that can be leveraged for local privilege escalation. Make snd_pcm_mmap_data() participate in the buffer-access scheme introduced for hw_params/hw_free: acquire runtime->buffer_accessing before validating and remapping, and release it afterwards. Buffer reallocation already fails with -EBUSY while accessors are active, and the mmap side now fails with -EBUSY while a reallocation is in progress, so the validate/remap sequence and the check/free sequence can no longer interleave. A reproducer that turns this race into a stale writable mapping of the freed DMA buffer pages is available on request.

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 92ee3c60ec9fe64404dc035e7c41277d74aa26cb, < cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5; >= 92ee3c60ec9fe64404dc035e7c41277d74aa26cb, < fd137bf8149bc6460f9b7b1fc292025da04cb9ee; >= 92ee3c60ec9fe64404dc035e7c41277d74aa26cb, < 8c1882dfee8f404d118020664b73eb4592172226; >= 92ee3c60ec9fe64404dc035e7c41277d74aa26cb, < 9b110a9dcecc59516c77cb3c0caf1f492f75df2d; a42aa926843acca96c0dfbde2e835b8137f2f092; 9cb6c40a6ebe4a0cfc9d6a181958211682cffea9; fbeb492694ce0441053de57699e1e2b7bc148a69; 0f6947f5f5208f6ebd4d76a82a4757e2839a23f8; 33061d0fba51d2bf70a2ef9645f703c33fe8e438; 0090c13cbbdffd7da079ac56f80373a9a1be0bf8; 1bbf82d9f961414d6c76a08f7f843ea068e0ab7b; >= 4.14.279, < 4.15; >= 4.19.243, < 4.20; >= 5.4.193, < 5.5; >= 5.10.109, < 5.11; >= 5.15.32, < 5.16; >= 5.16.18, < 5.17; >= 5.17.1, < 5.18
LinuxLinux5.18

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98116?
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM stream lock, but the lock is released long before the buffer is actually freed: snd_pcm_sync_stop(), constraint refinement and do_free_pages() all happen in between. snd_pcm_mmap_data(), on the other hand, takes no lock at all: it validates against the old buffer's state and dma_bytes, remaps its pages into the VMA, and only then increments mmap_count. A concurrent mmap() can therefore slip in between the check and the free. remap_pfn_range() installs writable PTEs for the old buffer's pages without taking page references, and the subsequent do_free_pages() returns those pages to the page allocator while the VMA still maps them. This leaves a stale, writable mapping of freed pages: a page-level use-after-free that can be leveraged for local privilege escalation. Make snd_pcm_mmap_data() participate in the buffer-access scheme introduced for hw_params/hw_free: acquire runtime->buffer_accessing before validating and remapping, and release it afterwards. Buffer reallocation already fails with -EBUSY while accessors are active, and the mmap side now fails with -EBUSY while a reallocation is in progress, so the validate/remap sequence and the check/free sequence can no longer interleave. A reproducer that turns this race into a stale writable mapping of the freed DMA buffer pages is available on request.
How severe is CVE-2026-98116?
CVE-2026-98116 has a CVSS score of 7.8/10 (HIGH severity).
How do I fix CVE-2026-98116?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98116?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST