CVE-2026-98116: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-pwf2-cf6j-p6wx
Share
CVSS 7.8
Published
Advisory Summary

CVE-2026-98116 is a HIGH (CVSS 7.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98116 at a Glance

CVE Identifier CVE-2026-98116
GHSA Identifier GHSA-pwf2-cf6j-p6wx
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-98116

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98116, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM stream lock, but the lock is released long before the buffer is actually freed: snd_pcm_sync_stop(), constraint refinement and do_free_pages() all happen in between. snd_pcm_mmap_data(), on the other hand, takes no lock at all: it validates against the old buffer's state and dma_bytes, remaps its pages into the VMA, and only then increments mmap_count. A concurrent mmap() can therefore slip in between the check and the free. remap_pfn_range() installs writable PTEs for the old buffer's pages without taking page references, and the subsequent do_free_pages() returns those pages to the page allocator while the VMA still maps them. This leaves a stale, writable mapping of freed pages: a page-level use-after-free that can be leveraged for local privilege escalation. Make snd_pcm_mmap_data() participate in the buffer-access scheme introduced for hw_params/hw_free: acquire runtime->buffer_accessing before validating and remapping, and release it afterwards. Buffer reallocation already fails with -EBUSY while accessors are active, and the mmap side now fails with -EBUSY while a reallocation is in progress, so the validate/remap sequence and the check/free sequence can no longer interleave. A reproducer that turns this race into a stale writable mapping of the freed DMA buffer pages is available on request.

References

NVD — CVE-2026-98116 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98116
git.kernel.org/stable/c/8c1882dfee... WEB
https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226
git.kernel.org/stable/c/9857a75714... WEB
https://git.kernel.org/stable/c/9857a75714bb5df4781e4d8b1a1753b1e17bf07a
git.kernel.org/stable/c/9b110a9dce... WEB
https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d
git.kernel.org/stable/c/cbadf2575d... WEB
https://git.kernel.org/stable/c/cbadf2575d25e7dcc0d4da2717817ae569fbc99b
git.kernel.org/stable/c/cbc7ec9760... WEB
https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5
git.kernel.org/stable/c/e6cdd2a047... WEB
https://git.kernel.org/stable/c/e6cdd2a0470d64073349a970dc1691433804b271
git.kernel.org/stable/c/fd137bf814... WEB
https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee

Frequently Asked Questions

What is CVE-2026-98116?
CVE-2026-98116 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98116?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-98116?
CVE-2026-98116 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-98116?
CVE-2026-98116 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98116?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pwf2-cf6j-p6wx",
  "modified" : "2026-10-03T12:31:28Z",
  "published" : "2026-09-25T12:31:37Z",
  "aliases" : [ "CVE-2026-98116" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF\n\nsnd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation\nwith an mmap_count check performed under the PCM stream lock, but the\nlock is released long before the buffer is actually freed:\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all\nhappen in between.  snd_pcm_mmap_data(), on the other hand, takes no\nlock at all: it validates against the old buffer's state and\ndma_bytes, remaps its pages into the VMA, and only then increments\nmmap_count.\n\nA concurrent mmap() can therefore slip in between the check and the\nfree.  remap_pfn_range() installs writable PTEs for the old buffer's\npages without taking page references, and the subsequent\ndo_free_pages() returns those pages to the page allocator while the\nVMA still maps them.  This leaves a stale, writable mapping of freed\npages: a page-level use-after-free that can be leveraged for local\nprivilege escalation.\n\nMake snd_pcm_mmap_data() participate in the buffer-access scheme\nintroduced for hw_params/hw_free: acquire runtime->buffer_accessing\nbefore validating and remapping, and release it afterwards.  Buffer\nreallocation already fails with -EBUSY while accessors are active,\nand the mmap side now fails with -EBUSY while a reallocation is in\nprogress, so the validate/remap sequence and the check/free sequence\ncan no longer interleave.\n\nA reproducer that turns this race into a stale writable mapping of\nthe freed DMA buffer pages is available on request.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98116"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8c1882dfee8f404d118020664b73eb4592172226"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9857a75714bb5df4781e4d8b1a1753b1e17bf07a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9b110a9dcecc59516c77cb3c0caf1f492f75df2d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cbadf2575d25e7dcc0d4da2717817ae569fbc99b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cbc7ec97601d09b74e05e44470fa6b0bcdabf3f5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e6cdd2a0470d64073349a970dc1691433804b271"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/fd137bf8149bc6460f9b7b1fc292025da04cb9ee"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-25T11:17:42Z"
  }
}