Linux Kernel CVE-2026-98116

Requires local access to an ALSA PCM character device under /dev/snd (PR:L) and the ability to run concurrent threads issuing mmap() against a PCM stream while triggering buffer reallocation via SNDRV_PCM_IOCTL_HW_PARAMS/HW_FREE. Exploitation is a race condition: the attacker must win the window between snd_pcm_mmap_data() validating/remapping the old buffer and do_free_pages() freeing it - success is timing-dependent (limiting factor), though a reproducer reportedly makes it practical. No user interaction and no elevated privileges beyond audio-device access are needed; the flaw exists in default configurations on kernels compiled with ALSA PCM support (essentially all desktop/audio Linux builds). Not exploitable remotely.

This is one of the higher-priority Linux kernel flaws in the recent stable-tree batch because its impact is a genuine local privilege-escalation primitive rather than the crash-only DoS that is frequently mislabeled with C:H/I:H in this CVE family. The described mechanism - remap_pfn_range() installing WRITABLE PTEs for buffer pages that do_free_pages() then returns to the page allocator, leaving a stale writable mapping of freed pages that get reallocated to other kernel/user objects - cleanly supports the CVSS impact triad (C:H/I:H/A:H). The vendor CVSS is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). I concur on impact and vector (AV:L, PR:L) but consider AC:L optimistic: exploitation is a TOCTOU race between a concurrent mmap() and the hw_params/hw_free reallocation path, which is inherently timing-dependent (AC:H is more honest, giving ~7.0), though the author notes a working reproducer exists which narrows that gap. No EPSS score, no CISA KEV entry, and no public exploit are present in the input - the reproducer is 'available on request', so it is NOT public. Net: a real, patch-worthy LPE candidate for prioritized kernel patching, but not evidence of in-the-wild exploitation. Signals are consistent (no CVSS-vs-description conflict); the main uncertainty is exploit reliability of the race, not the severity class.

A local unprivileged (or low-privileged) user with access to a PCM device under /dev/snd opens two threads: one repeatedly calls mmap() on the PCM stream while the other drives snd_pcm_hw_params()/hw_free() to force buffer reallocation. By winning the race so the mmap validates and maps the old buffer just before do_free_pages() frees it, the attacker obtains a writable mapping of freed pages that the allocator later hands to other objects, then writes through it to corrupt kernel-owned data and escalate privileges. A private reproducer is stated to be available on request, but no public exploit code exists.