The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and     snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM stream lock,     but the lock is released long before the buffer is actually freed: snd_pcm_sync_stop(), constraint     refinement and do_free_pages() all happen in between. snd_pcm_mmap_data(), on the other hand, takes no     lock at all: it validates against the old buffer's state and dma_bytes, remaps its pages into the VMA, and     only then increments mmap_count. A concurrent mmap() can therefore slip in between the check and the free.
    remap_pfn_range() installs writable PTEs for the old buffer's pages without taking page references, and     the subsequent do_free_pages() returns those pages to the page allocator while the VMA still maps them.
    This leaves a stale, writable mapping of freed pages: a page-level use-after-free that can be leveraged     for local privilege escalation. Make snd_pcm_mmap_data() participate in the buffer-access scheme     introduced for hw_params/hw_free: acquire runtime->buffer_accessing before validating and remapping, and     release it afterwards. Buffer reallocation already fails with -EBUSY while accessors are active, and the     mmap side now fails with -EBUSY while a reallocation is in progress, so the validate/remap sequence and     the check/free sequence can no longer interleave. A reproducer that turns this race into a stale writable     mapping of the freed DMA buffer pages is available on request. (CVE-2026-98116)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-98116

high Nessus Plugin ID 350626

Version 1.10

Version 1.9

Version 1.7

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.10 Oct 6, 2026, 8:42 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") Plugin Feed: 202610060842
Version 1.9 Oct 5, 2026, 10:36 PM CVSS metrics ("CVSSv2 score" set to 6.9) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C") Detection (updated detection logic) Plugin Feed: 202610052236
Version 1.7 Oct 2, 2026, 6:07 PM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-98116, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202610021807
Version 1.4 Sep 30, 2026, 6:31 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609300631
Version 1.3 Sep 29, 2026, 4:08 PM CVSS metrics ("CVSSv2 score" set to 7.2) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-98116, severity increased from "Medium" to "High") Detection (updated detection logic) Plugin metadata Plugin Feed: 202609291608
Version 1.2 Sep 28, 2026, 8:04 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-98116, severity decreased from "High" to "Medium") Plugin Feed: 202609280804
Version 1.1 Sep 26, 2026, 2:30 AM New Plugin Feed: 202609260230