Linux Kernel EUVD-2026-27687

Requires authenticated local access with standard user privileges (PR:L). Attacker must have permission to access ALSA OSS mixer device nodes (/dev/mixer, typically world-readable/writable or group audio-accessible on default Linux configurations). System must have OSS emulation compiled and loaded (CONFIG_SND_MIXER_OSS kernel configuration option, snd-mixer-oss module). Exploitation requires the ability to trigger sound card disconnect events during active mixer operations, achievable via: physical removal of USB/hotpluggable audio devices, sysfs-based driver unbind operations (echo device-id > /sys/bus/.../drivers/.../unbind), or kernel module unload if permissions allow. Attack complexity is low (AC:L) but practical exploitation depends on winning a race condition between mixer operation and card disconnect timing. Systems without removable audio hardware or with OSS emulation disabled are not affected. Desktop/workstation environments with USB audio support and multiple local users present higher risk than embedded systems with soldered audio codecs.

CVSS 7.8 indicates high severity with local attack vector, low complexity, and low privilege requirements (AV:L/AC:L/PR:L), meaning any authenticated local user can exploit this without special conditions. However, real-world risk is substantially lower than raw CVSS suggests. EPSS probability of 0.02% (5th percentile) indicates extremely low observed exploitation in the wild. Not listed in CISA KEV, confirming absence of confirmed active exploitation. No public POC identified. Exploitation requires local authenticated access plus the ability to trigger sound card disconnect events during active OSS mixer operations - achievable via hotplugging USB audio devices or forcing driver unload during mixer access, but this represents a narrow attack window. The UAF primitive could theoretically enable kernel memory corruption leading to privilege escalation, but practical exploitation requires winning the race condition and controlling freed memory contents. SSVC assessment: exploitation status is none, technical impact is total (kernel-level access), but automatable is no (requires precise timing and local access). Priority should be moderate - patch during normal update cycles for systems with untrusted local users and USB audio support, but this is not an emergency requiring out-of-band patching. The discrepancy between high CVSS and low EPSS reflects that local kernel UAF vulnerabilities are common but rarely exploited due to exploitation barriers.

An authenticated local attacker with low privileges opens an OSS mixer device node (/dev/mixer) and initiates a series of mixer control operations (volume adjustments, mute toggles) via legacy ioctl calls. Simultaneously, the attacker triggers a USB audio device disconnect event (physically removing device or forcing driver unbind via sysfs). By precisely timing the disconnect during pending mixer kcontrol operations, the attacker creates a race condition where the OSS mixer layer accesses freed kernel memory structures after card removal. Successful exploitation of the use-after-free allows arbitrary kernel memory corruption, potentially leading to privilege escalation to root or kernel-mode code execution. No public POC exists, but the attack scenario is feasible on systems with hotpluggable audio hardware and untrusted local users.