All vulnerabilities
CVE-2026-98314

Linux: ALSA: pcm: set timer->private_data before registering the PCM timer

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in27f167e117eca310661fbcbacb352ea08face067Also 555d168bd98daa46daccc68c908201388c834293, 8c869d5cf5affb20994bdbb60e7d46d65c91b55f and 3 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 27f167e117eca310661fbcbacb352ea08face067LinuxCVE List
  • 555d168bd98daa46daccc68c908201388c834293LinuxCVE List
  • 8c869d5cf5affb20994bdbb60e7d46d65c91b55fLinuxCVE List
  • 686c7a6af1eea8d2a919303e4c6bbec3de79dbdcLinuxCVE List
  • 0b349249d572633d7c8cdeb917623d1676a2b7c3LinuxCVE List
  • 1e713f9bb2ac583521f06b0eb4e22440b1e3d078LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: set timer->private_data before registering the PCM timer

snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream.

Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference:

substream = timer->private_data; return substream->runtime ? ... // substream is NULL

Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe.

Text from CVE List

Affected versions 18

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 27f167e117eca310661fbcbacb352ea08face067CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 555d168bd98daa46daccc68c908201388c834293CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8c869d5cf5affb20994bdbb60e7d46d65c91b55fCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 686c7a6af1eea8d2a919303e4c6bbec3de79dbdcCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e1eee8f16628f8b6bcae0a366fd6a2dd65e71eddCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d63f5a9f8121fb43c798056d7dd34c58f47185d7CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 0b349249d572633d7c8cdeb917623d1676a2b7c3CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1e713f9bb2ac583521f06b0eb4e22440b1e3d078CVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8