Linux Kernel CVE-2026-97931

Requires local access with an account that can open the us122l hwdep character node O_RDWR (typically membership in the audio group / access to /dev/snd), AND a physically-connected Tascam US-122L (or compatible us122l/usx2y) USB audio device - the driver code path does not exist without the hardware. Exploitation further requires establishing a PROT_READ mmap of the read buffer and then using mprotect() to upgrade it, plus manipulating usb_stream read_size around the mremap()/fault or free path (reflected in AC:H). Limiting factors: no remote vector (AV:L), authentication required (PR:L), the niche hardware dependency, and the fact that default single-user desktops rarely expose this node to untrusted users.

This is a locally-exploitable memory-safety flaw in the Linux ALSA us122l driver (Tascam US-122L USB audio interface), and the real-world risk is modest despite the 7.0 'HIGH' CVSS rating. The provided CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) already constrains it to a local attacker who holds valid credentials and can open the hwdep node O_RDWR (PR:L), with high attack complexity (AC:H) reflecting the mprotect()/mremap() sequencing and the hard requirement that the specific USB device be physically present. There is no EPSS score, no CISA KEV listing, and no public POC in the supplied data - so this is 'no public exploit identified at time of analysis,' not active exploitation. The C:H/I:H/A:H impact rating appears overstated: the described primitive is an out-of-bounds read of pages adjacent to the read buffer (a genuine but bounded information-disclosure/corruption vector) plus a free_pages_exact() releasing pages outside the allocation (crash/corruption/DoS), which realistically maps closer to C:L/I:L/A:H than full C:H/I:H/A:H. Net: this is a low-priority, defense-in-depth fix for the vast majority of systems, not an urgent patch - it only matters where the affected USB audio hardware is actually attached and untrusted local users have hwdep access. No conflicting signals between vector and description (both indicate local access); the main caveat is that impact severity is inferred and likely lower than NVD's C:H/I:H/A:H.

An unprivileged-but-authorized local user on a machine with a Tascam US-122L attached opens the hwdep node O_RDWR and mmap()s the read buffer with PROT_READ, then calls mprotect() to upgrade the still-VM_MAYWRITE mapping to writable. By writing to struct usb_stream's read_size before triggering the fault handler or usb_stream_free(), they cause the kernel to map/access pages beyond the allocation (leaking adjacent kernel memory) and free_pages_exact() to release pages outside the buffer (corruption/crash). No public POC is referenced; exploitation is gated by AC:H sequencing and the presence of the specific hardware.