CVE-2026-101308None▾ SunlitWhen an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this win…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.
An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-58094High· 7.8The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object
CVE-2026-101309NoneThe xHCI (USB 3) device model did not validate or save the event ring size provided by the guest
CVE-2026-101310NoneThe HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream
CVE-2026-101311NoneThe framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync
CVE-2026-101307NoneWhen the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter
CVE-2026-101305Nonerenameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments