CVE-2026-49417

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An issue exists where the audio buffer backing a mapping could be freed upon closing the device while the mapping remains valid. This allows the freed memory to be reused elsewhere while remaining accessible through a stale mapping. Because the /dev/dsp device nodes are world-accessible by default, an unprivileged local user can read and write kernel memory. This can lead to privilege escalation, potentially granting full control of the system, or cause a kernel crash resulting in a Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.