CVE-2026-98314

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer->private_data before registering the PCM timer snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream. Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference: substream = timer->private_data; return substream->runtime ? ... // substream is NULL Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98314

EUVD

EUVD-2026-93299

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	2.6.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL-pointer dereference vulnerability in the Linux kernel's ALSA PCM timer subsystem. It occurs when a timer is registered before its private_data field is set, allowing concurrent access to cause a crash by dereferencing a NULL pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA PCM timer subsystem and requires kernel-level inspection. Detection involves checking kernel logs for NULL-pointer dereference errors in snd_pcm_timer_init() or examining the timer->private_data state during PCM timer operations. No direct network detection commands exist; focus on system logs and kernel traces.

Impact Analysis

This could cause system crashes or instability when audio operations are performed. Attackers might exploit it to trigger denial-of-service conditions on affected Linux systems.

Compliance Impact

This vulnerability causes a NULL-pointer dereference in the Linux kernel's ALSA PCM timer subsystem, leading to potential system crashes or instability. While it does not directly expose data, such kernel-level issues could indirectly impact compliance by disrupting secure system operations required by standards like GDPR or HIPAA.

Mitigation Strategies

Apply the Linux kernel patch that moves timer->private_data assignment before snd_device_register(). Update to a kernel version containing the fix. If immediate patching is not possible, restrict access to /proc/asound/timers and disable ALSA PCM timer operations until patched.

Hi! I’m here to help you understand CVE-2026-98314. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70