SB20260928273 - Improper privilege management in Linux kernel usb usx2y

Description

This security bulletin contains information about 1 vulnerability.

1) Improper privilege management (CVE-ID: CVE-2026-97931)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to improper memory mapping permission handling in the ALSA us122l hwdep mmap callback when using mprotect() on a read-buffer mapping after opening the hwdep node O_RDWR. A local user can upgrade the read-buffer mapping to writable and modify the read_size member to cause memory corruption.

The read VMA remains expandable because pcm_usb_stream uses mremap() after reading read_size.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0eb9dd4774af0ac4d1fd105ef2b0a1f6cec06f2f
• https://git.kernel.org/stable/c/64a87950239867682cde128020e1a47088295e5c
• https://git.kernel.org/stable/c/71c610aeb1770302ac9c9e0b9a4ecd37f1311928
• https://git.kernel.org/stable/c/d9c537b14f4982f17b103e3a2cfeee4bee6bc026