Executive brief
A flaw in the Linux kernel's ALSA USB audio driver (usx2y) allows unprivileged users with access to a USB audio device to map arbitrary kernel memory pages into their process address space with read-write permissions. An attacker could exploit this to read or modify sensitive kernel data, potentially leading to privilege escalation or system compromise.
Technical details
The vulnerability exists in the snd_us428ctls_vm_fault() function in the ALSA usx2y driver, which handles memory-mapped I/O for a shared memory region. The fault handler converts a page offset (from the mmap() call) into a kernel virtual address without validating that the offset remains within the allocated single-page shared memory region. The mmap() validation in snd_us428ctls_mmap() only checks mapping length, not offset. For character devices, the mm layer's file_mmap_size_max() returns ULONG_MAX, imposing no ceiling. This allows any user who can open the hwdep (hardware dependent) device node and load an FPGA image to specify an arbitrary offset and gain read-write access to arbitrary kernel pages. The fix involves rejecting any offset that falls outside the shared memory region bounds.
Affected products
- Linux Linux kernel 7.2.0-rc5 and likely earlier
Timeline
- 2026-08-22: disclosed