CVE-2026-97931: ALSA: us122l: Prevent write upgrades for read mappings
In the Linux kernel, the following vulnerability has been resolved:
ALSA: us122l: Prevent write upgrades for read mappings
The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwdep node ORDWR can later use mprotect() to make the mapping writable.
The read allocation begins with struct usbstream. Its readsize member is used by the fault handler to decide which pages belong to the read buffer. The read VMA intentionally remains expandable because pcmusbstream uses mremap() after reading that size. Changing readsize first can therefore map and access pages beyond the allocation. The same member is also consumed by usbstreamfree(), where changing it can make freepagesexact() release pages outside the allocation.
Clear VMMAYWRITE for read-buffer mappings after rejecting an initially writable VMA. This keeps the separate output-buffer mapping writable while preventing later permission upgrades.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the ALSA us122l hwdep mmap callback, reject read-buffer mappings that are initially writable and clear VM_MAYWRITE on read-buffer VMAs to prevent later mprotect() permission upgrades.
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
A process must be able to open the affected hwdep device node with O_RDWR. It must then create a read-buffer mapping and use mprotect() to upgrade that mapping to writable access.
What is the practical impact of a successful permission upgrade?
The process can alter the read_size member in the read allocation. This may permit access to pages beyond the allocation and can cause usb_stream_free() to release pages outside the allocation.
Which mappings should remain writable after the fix?
The separate output-buffer mapping remains writable. The change specifically prevents later write-permission upgrades for read-buffer mappings.