CVE-2026-97931 (GCVE-0-2026-97931)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:22 – Updated: 2026-09-25 14:41
VLAI
Title
ALSA: us122l: Prevent write upgrades for read mappings
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VM_MAYWRITE set on mappings created with PROT_READ. A process that can open the hwdep node O_RDWR can later use mprotect() to make the mapping writable. The read allocation begins with struct usb_stream. Its read_size member is used by the fault handler to decide which pages belong to the read buffer. The read VMA intentionally remains expandable because pcm_usb_stream uses mremap() after reading that size. Changing read_size first can therefore map and access pages beyond the allocation. The same member is also consumed by usb_stream_free(), where changing it can make free_pages_exact() release pages outside the allocation. Clear VM_MAYWRITE for read-buffer mappings after rejecting an initially writable VMA. This keeps the separate output-buffer mapping writable while preventing later permission upgrades.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < 64a87950239867682cde128020e1a47088295e5c (git)
Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < d9c537b14f4982f17b103e3a2cfeee4bee6bc026 (git)
Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < 0eb9dd4774af0ac4d1fd105ef2b0a1f6cec06f2f (git)
Affected: 030a07e441296c372f946cd4065b5d831d8dc40c , < 71c610aeb1770302ac9c9e0b9a4ecd37f1311928 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.28
Unaffected: 0 , < 2.6.28 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/usx2y/us122l.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "64a87950239867682cde128020e1a47088295e5c",
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "versionType": "git"
            },
            {
              "lessThan": "d9c537b14f4982f17b103e3a2cfeee4bee6bc026",
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "versionType": "git"
            },
            {
              "lessThan": "0eb9dd4774af0ac4d1fd105ef2b0a1f6cec06f2f",
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "versionType": "git"
            },
            {
              "lessThan": "71c610aeb1770302ac9c9e0b9a4ecd37f1311928",
              "status": "affected",
              "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/usx2y/us122l.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.28"
            },
            {
              "lessThan": "2.6.28",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us122l: Prevent write upgrades for read mappings\n\nThe hwdep mmap callback rejects read-buffer mappings that are initially\nwritable, but leaves VM_MAYWRITE set on mappings created with PROT_READ.\nA process that can open the hwdep node O_RDWR can later use mprotect() to\nmake the mapping writable.\n\nThe read allocation begins with struct usb_stream. Its read_size member is\nused by the fault handler to decide which pages belong to the read buffer.\nThe read VMA intentionally remains expandable because pcm_usb_stream uses\nmremap() after reading that size. Changing read_size first can therefore\nmap and access pages beyond the allocation. The same member is also\nconsumed by usb_stream_free(), where changing it can make\nfree_pages_exact() release pages outside the allocation.\n\nClear VM_MAYWRITE for read-buffer mappings after rejecting an initially\nwritable VMA. This keeps the separate output-buffer mapping writable while\npreventing later permission upgrades."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bad data is written by a local process. It maps the us122l hwdep read buffer PROT_READ via usb_stream_hwdep_mmap(), upgrades it with mprotect() because VM_MAYWRITE was never cleared, and overwrites usb_stream.read_size. No remote protocol or USB packet carries the malicious value.\nAC:H - The driver only binds, and only creates /dev/snd/hwC*D*, when a TASCAM US-122L/US-144 is attached. A local attacker can\u0027t produce that hardware without physical access. Once it is present, mmap, mprotect, a read_size overwrite and mremap are fully deterministic.\nPR:L - The attacker needs an O_RDWR open of the hwdep node, which a normal user gets through audio group or seat uaccess ACLs. usb_stream_hwdep_open() and usb_stream_hwdep_ioctl() do no capability checks, and the stream already exists from probe.\nUI:N - The attacker\u0027s own process does the open, mmap, mprotect, write to read_size, mremap and page faults. No other user has to act.\nS:U - The result is corrupted kernel memory and local privilege escalation within the same kernel authority. No VM or hardware isolation boundary is crossed.\nC:H - With an inflated read_size, usb_stream_hwdep_vm_fault() maps virt_to_page((char *)s + offset) for offsets past the alloc_pages_exact() buffer. Userspace can then directly read arbitrary adjacent kernel pages.\nI:H - Those out-of-bounds pages are mapped writable into userspace, giving direct write access to kernel memory. In addition, usb_stream_free() calls free_pages_exact(s, read_size) with the tampered size, freeing pages that are still in use, a page-level use-after-free.\nA:H - Writing to foreign kernel pages, or freeing the wrong pages through usb_stream_free() on SET_PARAMS re-init or disconnect, corrupts the page allocator and kernel data, which leads to an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:39.476Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/64a87950239867682cde128020e1a47088295e5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9c537b14f4982f17b103e3a2cfeee4bee6bc026"
        },
        {
          "url": "https://git.kernel.org/stable/c/0eb9dd4774af0ac4d1fd105ef2b0a1f6cec06f2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/71c610aeb1770302ac9c9e0b9a4ecd37f1311928"
        }
      ],
      "title": "ALSA: us122l: Prevent write upgrades for read mappings",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97931",
    "datePublished": "2026-09-25T10:22:47.382Z",
    "dateReserved": "2026-09-25T10:18:58.203Z",
    "dateUpdated": "2026-09-25T14:41:39.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97931",
      "date": "2026-09-27",
      "epss": "0.00144",
      "percentile": "0.03093"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-27T23:17:26.000Z",
      "cve": "CVE-2026-97931",
      "id": "msrc_CVE-2026-97931",
      "initial_release_date": "2026-09-27T23:17:26.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ALSA: us122l: Prevent write upgrades for read mappings",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97931.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/usb/usx2y/us122l.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "64a87950239867682cde128020e1a47088295e5c",
                    "status": "affected",
                    "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9c537b14f4982f17b103e3a2cfeee4bee6bc026",
                    "status": "affected",
                    "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0eb9dd4774af0ac4d1fd105ef2b0a1f6cec06f2f",
                    "status": "affected",
                    "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "71c610aeb1770302ac9c9e0b9a4ecd37f1311928",
                    "status": "affected",
                    "version": "030a07e441296c372f946cd4065b5d831d8dc40c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "sound/usb/usx2y/us122l.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.28"
                  },
                  {
                    "lessThan": "2.6.28",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us122l: Prevent write upgrades for read mappings\n\nThe hwdep mmap callback rejects read-buffer mappings that are initially\nwritable, but leaves VM_MAYWRITE set on mappings created with PROT_READ.\nA process that can open the hwdep node O_RDWR can later use mprotect() to\nmake the mapping writable.\n\nThe read allocation begins with struct usb_stream. Its read_size member is\nused by the fault handler to decide which pages belong to the read buffer.\nThe read VMA intentionally remains expandable because pcm_usb_stream uses\nmremap() after reading that size. Changing read_size first can therefore\nmap and access pages beyond the allocation. The same member is also\nconsumed by usb_stream_free(), where changing it can make\nfree_pages_exact() release pages outside the allocation.\n\nClear VM_MAYWRITE for read-buffer mappings after rejecting an initially\nwritable VMA. This keeps the separate output-buffer mapping writable while\npreventing later permission upgrades."
          }
        ],
        "id": "CVE-2026-97931",
        "lastModified": "2026-09-25T15:18:02.450",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:20.387",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0eb9dd4774af0ac4d1fd105ef2b0a1f6cec06f2f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/64a87950239867682cde128020e1a47088295e5c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/71c610aeb1770302ac9c9e0b9a4ecd37f1311928"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d9c537b14f4982f17b103e3a2cfeee4bee6bc026"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.