CVE-2026-45258

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An integer overflow occurs in the dsp mmap single() function when validating requested mappings by summing a user-supplied offset and length against the buffer size. A large offset and length can wrap around, bypassing the check. Subsequently, the offset is narrowed from 64 to 32 bits during conversion to a buffer address, creating a mapping that extends beyond the audio buffer into unrelated kernel memory. Because /dev/dsp device nodes are world-accessible by default, an unprivileged local user can read and write kernel memory. This can lead to privilege escalation, full system control, or a Denial of Service (DoS) by crashing the kernel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.