CVE-2026-101308

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A race condition exists in the sound(4) driver when resizing an audio channel buffer. The driver verifies that the buffer is not memory-mapped and releases the channel lock to allocate a new buffer. If an mmap(2) call occurs on another thread during this interval, the resize process may free the buffer while it is still mapped. This can allow an unprivileged local user with sound device access to trigger a use-after-free condition in the kernel, which may lead to privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.