CVE-2026-98054

A flaw was found in the Linux kernel's Intel Audio Voice Speech (AVS) sound driver. When an error occurs while opening the driver's debugfs trace interface, the kernel fails to release a previously acquired module reference count. A local user with access to the interface can exploit this issue by triggering initialization failures, causing an unbalanced reference count that prevents the module from unloading and leads to a denial of service (DoS).

A flaw was found in the Linux kernel's Intel Audio Voice Speech (AVS) sound driver, which Red Hat has rated as having low security impact. When the driver's debugfs trace interface is opened, strace_open() acquires a module reference with try_module_get(), but if a subsequent initialization step fails, the acquired reference is not released with module_put(). A local user with access to the debugfs trace interface could trigger such initialization failures repeatedly, causing an unbalanced module reference count that prevents the AVS driver module from being unloaded, resulting in a local denial of service. No memory corruption, information disclosure, or privilege escalation is involved.

Within Red Hat products, the vulnerable code is present in recent Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 kernel streams, in Red Hat In-Vehicle OS 2, and in OpenShift Container Platform releases that ship RHEL 9 based CoreOS images. Earlier Red Hat Enterprise Linux 6, 7, and 8 streams (including the kernel and kernel-rt builds), the Red Hat Enterprise Linux 9.2 and 9.4 update streams, and OpenShift Container Platform 4.12 through 4.18 do not contain the vulnerable code and are therefore not affected.

Although the CVSS 3.1 base score is 5.5 (Moderate), Red Hat rates the impact of this flaw as low because the vulnerable code path is reachable only through the debugfs trace interface, which is restricted to privileged local users (root/CAP_SYS_ADMIN) by default, and the consequence is limited to keeping the audio driver module loaded. Because of this low impact and the constrained attack path, fixes for the affected streams have been deferred to future scheduled updates; the residual risk is limited to a local denial of service that prevents the affected audio driver module from being unloaded.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code path is reachable only through the Intel AVS driver's debugfs trace interface, which requires privileged local access. Exposure can be reduced by not mounting the debugfs filesystem (for example, unmounting /sys/kernel/debug where it is not needed) or by restricting access to the debugfs trace entries to trusted administrators only. The issue is otherwise addressed by applying future scheduled kernel updates for the affected streams.