CVE-2026-97931: ALSA: us122l: Prevent write upgrades for read mappings

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ALSA: us122l: Prevent write upgrades for read mappings

The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwdep node ORDWR can later use mprotect() to make the mapping writable.

The read allocation begins with struct usbstream. Its readsize member is used by the fault handler to decide which pages belong to the read buffer. The read VMA intentionally remains expandable because pcmusbstream uses mremap() after reading that size. Changing readsize first can therefore map and access pages beyond the allocation. The same member is also consumed by usbstreamfree(), where changing it can make freepagesexact() release pages outside the allocation.

Clear VMMAYWRITE for read-buffer mappings after rejecting an initially writable VMA. This keeps the separate output-buffer mapping writable while preventing later permission upgrades.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    In the ALSA us122l hwdep mmap callback, reject read-buffer mappings that are initially writable and clear VM_MAYWRITE on read-buffer VMAs to prevent later mprotect() permission upgrades.

Event History

Sep 25, 2026
CVE Published
via MITRE·10:22 AM
Data Sourced
via MITRE·10:22 AM
DescriptionSeverity
Data Sourced
via NVD·11:17 AM
DescriptionSeverity

Frequently Asked Questions

1

What level of access is required to exploit this issue?

A process must be able to open the affected hwdep device node with O_RDWR. It must then create a read-buffer mapping and use mprotect() to upgrade that mapping to writable access.

2

What is the practical impact of a successful permission upgrade?

The process can alter the read_size member in the read allocation. This may permit access to pages beyond the allocation and can cause usb_stream_free() to release pages outside the allocation.

3

Which mappings should remain writable after the fix?

The separate output-buffer mapping remains writable. The change specifically prevents later write-permission upgrades for read-buffer mappings.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203