Linux Kernel CVE-2026-98054

Exploitation requires local, authenticated access (PR:L) on a system where the Intel AVS (Smart Sound Technology) ASoC driver is present and loaded - i.e., hardware with the Intel DSP audio stack, not arbitrary Linux hosts. The attacker must drive strace_open() so that try_module_get() succeeds and then a subsequent operation fails, leaking the reference; reaching that specific error path is the practical limiting factor. There is no remote vector (AV:L) and no user interaction. Limiting factors: requires a valid local account, the specific vulnerable kernel version, the avs driver actually in use, and repeated triggering of the failure path to accumulate leaked references into a meaningful availability impact.

This is a low-to-moderate priority local availability issue, not a widespread emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) describes a locally exploitable flaw requiring an authenticated low-privileged user, with no confidentiality or integrity impact - only availability. EPSS reinforces low concern at 0.17% (5th percentile), there is no CISA KEV listing, and no public exploit was identified, so the exploitation status is 'no public exploit identified at time of analysis.' All signals are consistent and point toward low real-world risk: the only divergence is the input 'Information Disclosure' tag, which directly contradicts the CVSS confidentiality metric (C:N) and the actual defect (a module reference-count leak), so that tag should be disregarded. No SSVC decision data was supplied. One caveat on severity: the upstream A:H rating is arguably generous - an unbalanced try_module_get() refcount leak prevents the avs module from being unloaded and slowly wastes a resource, rather than crashing a running system, so the practical availability impact is lower than a 'High' would suggest. Verify realistic impact against the specific deployment before prioritizing.

A local, authenticated low-privileged user with access to an Intel Smart Sound Technology (AVS) audio device repeatedly opens the ASoC avs interface along a path where strace_open() first calls try_module_get() and then a follow-up operation fails, leaking one module reference each time. Over many iterations this pins the module reference count so the driver can no longer be unloaded, degrading availability. No public exploit code was identified at time of analysis.