---
id: CVE-2026-98116
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

  snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation
  with an mmap_count check per…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

  snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation
  with an mmap_count check per…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 92ee3c60ec9fe64404dc035e7c41277d74aa26cb <
    cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5
  - >-
    Linux >= 92ee3c60ec9fe64404dc035e7c41277d74aa26cb <
    fd137bf8149bc6460f9b7b1fc292025da04cb9ee
  - >-
    Linux >= 92ee3c60ec9fe64404dc035e7c41277d74aa26cb <
    8c1882dfee8f404d118020664b73eb4592172226
  - >-
    Linux >= 92ee3c60ec9fe64404dc035e7c41277d74aa26cb <
    9b110a9dcecc59516c77cb3c0caf1f492f75df2d
  - Linux a42aa926843acca96c0dfbde2e835b8137f2f092
  - Linux 9cb6c40a6ebe4a0cfc9d6a181958211682cffea9
  - Linux fbeb492694ce0441053de57699e1e2b7bc148a69
  - Linux 0f6947f5f5208f6ebd4d76a82a4757e2839a23f8
  - Linux 33061d0fba51d2bf70a2ef9645f703c33fe8e438
  - Linux 0090c13cbbdffd7da079ac56f80373a9a1be0bf8
  - Linux 1bbf82d9f961414d6c76a08f7f843ea068e0ab7b
  - Linux >= 4.14.279 < 4.15
  - Linux >= 4.19.243 < 4.20
  - Linux >= 5.4.193 < 5.5
  - Linux >= 5.10.109 < 5.11
  - Linux >= 5.15.32 < 5.16
  - Linux >= 5.16.18 < 5.17
  - Linux >= 5.17.1 < 5.18
  - Linux 5.18
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:18:06.437'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98116'
references:
  - url: 'https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.822Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation
with an mmap_count check performed under the PCM stream lock, but the
lock is released long before the buffer is actually freed:
snd_pcm_sync_stop(), constraint refinement and do_free_pages() all
happen in between.  snd_pcm_mmap_data(), on the other hand, takes no
lock at all: it validates against the old buffer's state and
dma_bytes, remaps its pages into the VMA, and only then increments
mmap_count.

A concurrent mmap() can therefore slip in between the check and the
free.  remap_pfn_range() installs writable PTEs for the old buffer's
pages without taking page references, and the subsequent
do_free_pages() returns those pages to the page allocator while the
VMA still maps them.  This leaves a stale, writable mapping of freed
pages: a page-level use-after-free that can be leveraged for local
privilege escalation.

Make snd_pcm_mmap_data() participate in the buffer-access scheme
introduced for hw_params/hw_free: acquire runtime->buffer_accessing
before validating and remapping, and release it afterwards.  Buffer
reallocation already fails with -EBUSY while accessors are active,
and the mmap side now fails with -EBUSY while a reallocation is in
progress, so the validate/remap sequence and the check/free sequence
can no longer interleave.

A reproducer that turns this race into a stale writable mapping of
the freed DMA buffer pages is available on request.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.