CVE-2026-97931

Received Received - Intake

Memory Corruption in Linux Kernel ALSA us122l Driver

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VM_MAYWRITE set on mappings created with PROT_READ. A process that can open the hwdep node O_RDWR can later use mprotect() to make the mapping writable. The read allocation begins with struct usb_stream. Its read_size member is used by the fault handler to decide which pages belong to the read buffer. The read VMA intentionally remains expandable because pcm_usb_stream uses mremap() after reading that size. Changing read_size first can therefore map and access pages beyond the allocation. The same member is also consumed by usb_stream_free(), where changing it can make free_pages_exact() release pages outside the allocation. Clear VM_MAYWRITE for read-buffer mappings after rejecting an initially writable VMA. This keeps the separate output-buffer mapping writable while preventing later permission upgrades.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97931

EUVD

EUVD-2026-86785

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ALSA us122l driver's memory mapping mechanism. A process with read-write access can use mprotect() to make a read-only memory mapping writable after creation. This occurs because the VM_MAYWRITE flag remains set even when the mapping is initially rejected as writable. The issue stems from incorrect handling of the read_size member in struct usb_stream, which can lead to memory corruption or unauthorized access.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA us122l driver and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the presence of vulnerable kernel versions. Commands like 'dmesg | grep us122l' or 'uname -a' to check kernel version may help. No direct network detection commands are applicable.

Impact Analysis

An attacker with local access could exploit this to escalate privileges or corrupt system memory by modifying read-only mappings. This could lead to denial of service, data leaks, or arbitrary code execution. Systems using the affected ALSA us122l driver are at risk if the driver is loaded.

Compliance Impact

This vulnerability does not have a direct or documented impact on compliance with GDPR, HIPAA, or similar standards. The issue is specific to memory mapping in the Linux kernel's ALSA subsystem and does not involve data breaches, unauthorized access, or privacy violations typically addressed by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor kernel security advisories for updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-97931. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70