CVEFinder.io

CVE-2026-49417

⚠️ high
🔍 Scan for this CVE
Summary

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. A

Description

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping.

The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, which can be used to escalate privileges, potentially gaining full control of the affected system. At a minimum, an attacker can crash the kernel, resulting in a Denial of Service (DoS).

CVSS Score
7.0
High
EPSS Score
0.1
Exploit Probability
Published Date
2026-06-27
First Seen: 2026-06-28
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 51.7% of all 338,295 vulnerabilities in our database.

#163,552
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jun 29, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Lexpl0it, 75Acol, Liyw979, Rob1n
SSVC data provided by CISA
Last Modified 2026-07-01
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)

📦 Affected Products 3

🔗 References 1

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-45258 ⚠️ high 7.8 0.2 dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the... 2026-06-27
CVE-2026-45259 🔶 medium 6.5 0.1 sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation... 2026-06-27
CVE-2026-49412 ⚠️ high 7.8 0.1 The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, ... 2026-06-27
CVE-2026-49413 ⚠️ high 7.1 0.1 The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. Durin... 2026-06-27
CVE-2026-49414 ⚠️ high 7.8 0.1 The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the P... 2026-06-27
CVE-2026-49416 ⚠️ high 7.8 0.1 The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer ... 2026-06-27
These CVEs affect the same products