Linux Kernel CVE-2026-46157

Exploitation requires local shell access (CVSS AV:L) with at least an unprivileged user account (PR:L) on a kernel where the legacy OSS PCM emulation module (snd-pcm-oss) is loaded AND the attacker has read/write access to the OSS device nodes (/dev/dsp*, /dev/snd/pcm*), which by default is typically gated by membership in the 'audio' group or equivalent ACL. The attacker must additionally win a timing race between snd_pcm_oss_get_trigger() / snd_pcm_oss_poll() and a concurrent trigger-setting ioctl on the same PCM substream, so multi-core CPUs and the ability to spawn multiple threads are practical prerequisites. Limiting factors: modern distributions often do not load snd-pcm-oss by default (PulseAudio/PipeWire use native ALSA); headless servers and containers typically have no sound devices at all; UI:N means no user interaction is needed once the attacker has the prerequisite local access.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8 (High), reflecting local attack vector with low-privileged access required and high impact across confidentiality, integrity, and availability - typical of Linux kernel local privilege escalation scoring conventions. However, the real-world risk signals diverge sharply: EPSS is 0.02% (5th percentile), the CVE is not on CISA KEV, no PoC is referenced, and the bug requires an attacker to have local access to a system with the legacy OSS PCM emulation actually in use (the /dev/dsp* interface), which is uncommon on modern distributions. The 'Information Disclosure' tag in the input conflicts with the CVSS C:H/I:H/A:H impact triad and the description, which points to memory corruption of adjacent bit fields rather than info leak - this tag appears mislabeled and should be treated with caution. Net assessment: routine kernel hardening priority, not an emergency; patch on normal kernel update cadence unless OSS emulation is exposed to untrusted local users (e.g., multi-tenant or container hosts permitting raw audio device access).

A local low-privileged user on a multi-tenant Linux host opens /dev/dsp (the OSS PCM emulation device) from two threads and races snd_pcm_oss_get_trigger() / snd_pcm_oss_poll() calls against ioctl-driven trigger writes; the unsynchronized bit-field read-modify-write corrupts adjacent runtime state, which under careful timing can be turned into out-of-bounds behavior or kernel-state confusion suitable for privilege escalation. No public exploit identified at time of analysis, and the bug was found by fuzzing rather than in active exploitation, so weaponization would require dedicated exploit development against a specific kernel layout.