CVE-2026-98314: ALSA: pcm: set timer->private_data before registering the PCM timer

Published Oct 6, 2026

Updated

ALSA: pcm: set timer->privatedata before registering the PCM timer

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 6, 2026

CVE Published

via MITRE·08:46 AM

Data Sourced

via MITRE·08:46 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Oct 7, 2026

Data Sourced

via Microsoft·08:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required to trigger the crash?

A concurrent reader must access a newly registered PCM timer during the brief interval before its private_data pointer is initialized. The affected callbacks dereference that pointer while it is still NULL.

Which interfaces can reach the vulnerable callbacks?

Reading /proc/asound/timers can invoke the timer resolution callback. Opening and starting a timer through snd_timer_open() and snd_timer_start() can invoke the start or stop callbacks.

What is the observed impact when the race occurs?

The result is a NULL-pointer dereference because the callbacks access substream->runtime after obtaining a NULL substream from timer->private_data.

CVE-2026-98314: ALSA: pcm: set timer->private_data before registering the PCM timer

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger the crash?

Which interfaces can reach the vulnerable callbacks?

What is the observed impact when the race occurs?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the crash?

Which interfaces can reach the vulnerable callbacks?

What is the observed impact when the race occurs?