A race condition exists in the ALSA PCM interface of the Linux kernel where concurrent memory‑mapped operations can interleave with buffer deallocation. During this race a page that has been freed remains mapped as writable, creating a page‑level use‑after‑free. An attacker can exploit this stale writable mapping to execute arbitrary code or modify system memory, thereby achieving local privilege escalation.

All Linux kernel versions lacking the ALSA PCM mmap page‑UAF fix, regardless of vendor. The vulnerability is present in the kernel’s ALSA subsystem and applies to any system that allows a process to perform PCM mmap operations. No product or version exclusions are listed; users should consult kernel release notes for the commit that introduced the fix.

The vulnerability permits local exploitation only; a privileged user or a process that can invoke PCM mmap can race with the buffer free routine. The EPSS score of < 1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, suggesting limited likelihood of widespread exploitation. With a CVSS score of 7.8, the vulnerability is considered high severity, and any kernel update that patches the race should be prioritized.