CVE-2026-98314

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: set timer->private_data before registering the PCM timer

snd_pcm_timer_init() calls snd_device_register() to link the new

struct snd_timer into the global timer list while it still carries

hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop),

and only afterwards sets timer->private_data = substream.

Once the timer is on the list under register_mutex, a concurrent

reader can already reach it through the same mutex and invoke these

callbacks. /proc/asound/timers does this via c_resolution(), and

snd_timer_open()+snd_timer_start() reach start()/stop() the same way.

All three dereference timer->private_data, which for this brief

window is NULL, giving a NULL-pointer dereference:

substream = timer->private_data;

return substream->runtime ? ... // substream is NULL

Move the private_data/private_free assignment before

snd_device_register() so the timer is never visible on the list

without it

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References