Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VM_MAYWRITE set on mappings created with PROT_READ. A process that can open the hwdep node O_RDWR can later use mprotect() to make the mapping writable. The read allocation begins with struct usb_stream. Its read_size member is used by the fault handler to decide which pages belong to the read buffer. The read VMA intentionally remains expandable because pcm_usb_stream uses mremap() after reading that size. Changing read_size first can therefore map and access pages beyond the allocation. The same member is also consumed by usb_stream_free(), where changing it can make free_pages_exact() release pages outside the allocation. Clear VM_MAYWRITE for read-buffer mappings after rejecting an initially writable VMA. This keeps the separate output-buffer mapping writable while preventing later permission upgrades.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-25T11:17:20.387Z",
  "pubdate": "2026-09-25T11:17:20.387Z",
  "executiveSummary": "The ALSA us122l driver contains a security flaw in its hwdep mmap callback mechanism, specifically concerning the handling of read-buffer memory mappings.\nThe vulnerability is categorized as an improper access control or missing permission restriction on memory mappings (CWE-284/CWE-276).\nIt allows a local attacker who can open the hwdep device node in read-write (O_RDWR) mode to leverage mprotect() to escalate the permissions of a read-only memory mapping to writable.\nThis unauthorized modification of memory permissions can lead to out-of-bounds memory access or arbitrary kernel memory corruption through the manipulation of the usb_stream structure.\nThe vulnerability specifically affects systems using the Tascam US-122L/US-144/US-122MKII/US-144MKII hardware interfaces via the Linux kernel's ALSA subsystem.\nThe primary risk is a local privilege escalation or system crash, as the kernel-space memory managed by these drivers can be manipulated through the modified mapping.\nExploitation requires local access to the system and the ability to interact with the device node, typically requiring membership in the audio group or equivalent device access permissions.",
  "technicalDetails": "The vulnerability resides in the mmap implementation of the ALSA hwdep interface within the us122l kernel driver. The driver failed to adequately clear the VM_MAYWRITE flag when initializing read-buffer memory mappings.\nWhile the driver's mmap callback correctly rejected initial attempts to map read-buffers as writable, it neglected to restrict future permission upgrades. Because VM_MAYWRITE remained set, user-space processes could invoke the mprotect() system call to upgrade a PROT_READ mapping to PROT_WRITE.\nThe root cause is an insecure integration with the kernel's Virtual Memory Area (VMA) management, where the driver failed to enforce permanent read-only status for memory regions intended to be managed exclusively by the kernel for streaming purposes.\nExploitation follows a specific attack flow: 1) An attacker opens the hwdep character device node (e.g., /dev/snd/hwCxD) with sufficient privileges. 2) The attacker performs an mmap() request for the read buffer with PROT_READ permissions. 3) The attacker utilizes mprotect() to modify the memory region to include PROT_WRITE. 4) With write access to the underlying memory, the attacker can manipulate the struct usb_stream members, specifically the read_size field.\nThe read_size member is critical to the driver's logic; it is used by the fault handler to determine page boundaries and by usb_stream_free() to invoke free_pages_exact(). By modifying read_size, an attacker can trick the kernel into accessing or freeing pages outside the intended allocated buffer.\nSuccessful exploitation can result in a kernel-level heap out-of-bounds read or write. By manipulating the size parameters before the kernel performs mremap() or cleanup operations, an attacker can influence the kernel's memory management state, potentially leading to arbitrary kernel memory corruption.\nThis vulnerability is localized to the us122l driver component of the ALSA sound system. As it is a driver-level vulnerability, it is accessible to any local user capable of accessing the specific device file, which is a standard requirement for audio hardware interaction in Linux environments."
}