Cloudanix VulnDB

CVE-2026-98314

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the Linux sound system could let local users crash the whole computer by racing with audio timer setup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in ALSA PCM timer initialization allows concurrent access to snd_timer structure before timer->private_data is set, resulting in NULL pointer dereference when callbacks like c_resolution, start, or stop are invoked.

Why it matters to the business

Unprivileged local users can trigger kernel crashes on Linux systems using ALSA audio, causing denial of service and potential system instability in audio-enabled environments.

How an attack unfolds

An attacker opens a PCM device to initiate snd_pcm_timer_init, then races with /proc/asound/timers reads or snd_timer_open/start operations to hit the brief window where the timer is registered but private_data remains NULL, dereferencing it in the callback path.

How to fix it

Apply the upstream kernel patch that assigns timer->private_data and private_free before snd_device_register; rebuild and deploy fixed kernel images to all affected systems.

How to confirm the fix worked

Inspect snd_pcm_timer_init source to confirm private_data assignment precedes register call; test with concurrent /proc/asound/timers access and PCM timer start/stop under load.

Typical attack path

  1. Open PCM substream to trigger timer creation
  2. Concurrently access timer via procfs or snd_timer APIs under register_mutex
  3. Invoke callbacks that dereference unset private_data
  4. Trigger NULL pointer dereference leading to kernel panic

How to detect it

Search kernel logs and crash dumps for oops traces referencing snd_pcm_timer_init, snd_timer callbacks, or NULL dereferences under ALSA timer paths; correlate with PCM device open events.

What your security team should do

  • Prioritize kernel updates on all Linux audio hosts within standard patch windows
  • Monitor kernel logs for NULL dereference oops involving snd_pcm_timer
  • Restrict unprivileged PCM device access where feasible via permissions or cgroups

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer->private_data before registering the PCM timer snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream. Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference: substream = timer->private_data; return substream->runtime ? ... // substream is NULL Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe.

Affected packages

Ecosystem Package Introduced Fixed