{"id":"CVE-2026-101308","published":"2026-10-15T07:17:58.007","lastModified":"2026-10-15T16:17:41.437","description":"When an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer.  An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.\n\nAn unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.","cvssScore":5.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-367"],"vendors":[],"products":[],"references":[{"url":"https://security.freebsd.org/advisories/FreeBSD-SA-26:71.sound.asc","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}