CVE-2026-98116

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation

with an mmap_count check performed under the PCM stream lock, but the

lock is released long before the buffer is actually freed:

snd_pcm_sync_stop(), constraint refinement and do_free_pages() all

happen in between. snd_pcm_mmap_data(), on the other hand, takes no

lock at all: it validates against the old buffer's state and

dma_bytes, remaps its pages into the VMA, and only then increments

mmap_count.

A concurrent mmap() can therefore slip in between the check and the

free. remap_pfn_range() installs writable PTEs for the old buffer's

pages without taking page references, and the subsequent

do_free_pages() returns those pages to the page allocator while the

VMA still maps them. This leaves a stale, writable mapping of freed

pages: a page-level use-after-free that can be leverag

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References