Emmanuel Genier

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An integer overflow occurs in the `dsp mmap single()` function when validating requested mappings by summing a user-supplied offset and length against the buffer size. A large offset and length can wrap around, bypassing the check. Subsequently, the offset is narrowed from 64 to 32 bits during conversion to a buffer address, creating a mapping that extends beyond the audio buffer into unrelated kernel memory. Because `/dev/dsp` device nodes are world-accessible by default, an unprivileged local user can read and write kernel memory. This can lead to privilege escalation, full system control, or a Denial of Service (DoS) by crashing the kernel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.