CVE-2026-97931

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) US122L audio driver, which can lead to memory corruption or a Denial of Service (DoS). The driver improperly permits read-only memory mappings to be upgraded to writable. A local user with read and write permissions to the device file can exploit this flaw to modify internal buffer parameters, causing the kernel to access or release memory outside allocated bounds.

An ALSA us122l hwdep read buffer mapping can be created with PROT_READ while retaining VM_MAYWRITE. A local process that can open the hwdep device with O_RDWR can later use mprotect() to make the mapping writable and modify struct usb_stream data including read_size. A modified read_size can cause mappings beyond the intended read allocation and can make usb_stream_free call free_pages_exact on pages outside the allocation. This creates a plausible kernel memory corruption condition with potential use after free or invalid free consequences. For the CVSS the PR:L metric reflects that the attacker needs local access to the affected hwdep device rather than full administrative privileges. The issue is not network reachable. Impact is at least local denial of service and may include confidentiality integrity and privilege escalation consequences due to the invalid page free primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.