CVE-2026-58091: Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl
The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility.
On a system with a multiple audio devices, an unprivileged local user can exploit this use-after-free to escalate privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems with multiple audio devices are exposed if unprivileged local users can access the affected audio ioctl. The issue is described as a local privilege-escalation vulnerability.
What does an attacker need to exploit it?
An attacker needs local access as an unprivileged user and a system with multiple audio devices. Exploitation involves the SNDCTL_DSP_SYNCSTART ioctl and a timing condition in which the sync group is freed while the ioctl is sleeping.