CVE-2026-98314 - Vulnerability Details

- ALSA: pcm: set timer->private_data before registering the PCM timer

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: set timer->private_data before registering the PCM timer

snd_pcm_timer_init() calls snd_device_register() to link the new
struct snd_timer into the global timer list while it still carries
hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop),
and only afterwards sets timer->private_data = substream.

Once the timer is on the list under register_mutex, a concurrent
reader can already reach it through the same mutex and invoke these
callbacks. /proc/asound/timers does this via c_resolution(), and
snd_timer_open()+snd_timer_start() reach start()/stop() the same way.
All three dereference timer->private_data, which for this brief
window is NULL, giving a NULL-pointer dereference:

substream = timer->private_data;
return substream->runtime ? ... // substream is NULL

Move the private_data/private_free assignment before
snd_device_register() so the timer is never visible on the list
without its private_data set. On the snd_device_register() failure
path, private_free() (snd_pcm_timer_free()) can now run, but it only
does substream->timer = NULL, which is already NULL at that point
since substream->timer is set to the new timer just once, after a
successful registration -- so the failure path stays safe.

Published: 2026-10-06

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition during ALSA PCM timer initialization causes the timer to be registered before its private_data field is set. When a concurrent read occurs, callbacks dereference the null private_data, resulting in a kernel fault that can crash the system.

Affected Systems

The kernel’s ALSA subsystem, specifically the PCM timer component, is affected. Any Linux kernel that includes the pre‑patch ALSA PCM timer code is potentially vulnerable, as the CNA lists the vendor and product as Linux:Linux. No specific kernel version range is given, so all affected kernels run unpatched code.

Risk and Exploitability

The vulnerability is local; an attacker with access to the target system who can interact with ALSA PCM timers or trigger the registration path can force a null‑pointer dereference. The CVSS score of 7.0 indicates a medium severity attack. The resulting kernel crash causes a denial of service. The likely attack vector is local interaction with ALSA PCM timers, inferred from the race condition during timer registration. The EPSS score of < 1% indicates a very low, but non‑zero, probability of exploitation, and the issue is not listed in the CISA KEV catalog, so the current exploitation likelihood is not quantified beyond that low probability, but the potential for a local crash remains.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 27f167e117eca310661fbcbacb352ea08face067
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 555d168bd98daa46daccc68c908201388c834293
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8c869d5cf5affb20994bdbb60e7d46d65c91b55f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 686c7a6af1eea8d2a919303e4c6bbec3de79dbdc
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e1eee8f16628f8b6bcae0a366fd6a2dd65e71edd
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d63f5a9f8121fb43c798056d7dd34c58f47185d7
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 0b349249d572633d7c8cdeb917623d1676a2b7c3
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1e713f9bb2ac583521f06b0eb4e22440b1e3d078

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,27f167e117eca310661fbcbacb352ea08face067)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,555d168bd98daa46daccc68c908201388c834293)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8c869d5cf5affb20994bdbb60e7d46d65c91b55f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,686c7a6af1eea8d2a919303e4c6bbec3de79dbdc)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e1eee8f16628f8b6bcae0a366fd6a2dd65e71edd)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d63f5a9f8121fb43c798056d7dd34c58f47185d7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0b349249d572633d7c8cdeb917623d1676a2b7c3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1e713f9bb2ac583521f06b0eb4e22440b1e3d078)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[0,5.11.0)`	unaffected	semver	—
`[0,5.16.0)`	unaffected	semver	—
`[0,6.2.0)`	unaffected	semver	—
`[0,6.7.0)`	unaffected	semver	—
`[0,6.13.0)`	unaffected	semver	—
`[0,6.19.0)`	unaffected	semver	—
`[0,7.3.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a kernel version that includes the ALSA PCM timer fix (commit 0b349249d572… and referenced Git links).
If an upgrade is not immediately feasible, disable the ALSA PCM timer subsystem by unloading the timer module or disabling the ALSA driver in the configuration.
As a last resort, limit user interactions with ALSA by adjusting permissions on /proc/asound or using audio restrictions to mitigate race exposure.

Generated by OpenCVE AI on October 10, 2026 at 01:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98314.mbox
https://git.kernel.org/stable/c/0b349249d572633d7c8cdeb917623d1676a2b7c3
https://git.kernel.org/stable/c/1e713f9bb2ac583521f06b0eb4e22440b1e3d078
https://git.kernel.org/stable/c/27f167e117eca310661fbcbacb352ea08face067
https://git.kernel.org/stable/c/555d168bd98daa46daccc68c908201388c834293
https://git.kernel.org/stable/c/686c7a6af1eea8d2a919303e4c6bbec3de79dbdc
https://git.kernel.org/stable/c/8c869d5cf5affb20994bdbb60e7d46d65c91b55f
https://git.kernel.org/stable/c/d63f5a9f8121fb43c798056d7dd34c58f47185d7
https://git.kernel.org/stable/c/e1eee8f16628f8b6bcae0a366fd6a2dd65e71edd
https://nvd.nist.gov/vuln/detail/CVE-2026-98314
https://www.cve.org/CVERecord?id=CVE-2026-98314

History

Sat, 10 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98314.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98314 https://www.cve.org/CVERecord?id=CVE-2026-98314
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 07 Oct 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Tue, 06 Oct 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Tue, 06 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer->private_data before registering the PCM timer snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream. Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference: substream = timer->private_data; return substream->runtime ? ... // substream is NULL Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe.
Title		ALSA: pcm: set timer->private_data before registering the PCM timer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b349249d572633d7c8cdeb917623d1676a2b7c3 https://git.kernel.org/stable/c/1e713f9bb2ac583521f06b0eb4e22440b1e3d078 https://git.kernel.org/stable/c/27f167e117eca310661fbcbacb352ea08face067 https://git.kernel.org/stable/c/555d168bd98daa46daccc68c908201388c834293 https://git.kernel.org/stable/c/686c7a6af1eea8d2a919303e4c6bbec3de79dbdc https://git.kernel.org/stable/c/8c869d5cf5affb20994bdbb60e7d46d65c91b55f https://git.kernel.org/stable/c/d63f5a9f8121fb43c798056d7dd34c58f47185d7 https://git.kernel.org/stable/c/e1eee8f16628f8b6bcae0a366fd6a2dd65e71edd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:46:09.965Z

Updated: 2026-10-19T09:17:24.800Z

Reserved: 2026-09-25T10:25:14.339Z

Link: CVE-2026-98314

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:23.033

Modified: 2026-10-19T10:18:33.520

Link: CVE-2026-98314

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98314 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-10T02:00:11Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object