CVE-2026-90116
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown snd_mtpav_output_timer() rearms chip->timer while holding chip->spinlock and accesses the card-private mtpav state. snd_mtpav_free() currently takes the same lock and calls timer_delete() when the timer is active. This only removes a pending timer; it does not wait for a callback that is already running and does not prevent the callback from rearming the timer. A callback running on another CPU can therefore continue after snd_mtpav_free() releases the lock and access the card-private state while the card is being torn down. It can also rearm the timer after timer_delete() has returned. Call timer_shutdown_sync() without holding chip->spinlock. This waits for any running callback to finish and prevents further rearming before the card-private mtpav state is released.
How to fix
- Linux Linuxa9435a1f14a6f9520452617343ea59bb35ba9e79, 793163e134028e7136c9dd9e30f7f656de1eabba, de75857ce374671712e1d9528844e3c0543dcef6, 392c985c6b03dfdf4904c0d464f18735ca3c4df8, 1e16e82581521a2fe20eda29bdc9e75286f7c950, c73cb5b7c159246dd572277c668851a56e516019 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < a9435a1f14a6f9520452617343ea59bb35ba9e79, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 793163e134028e7136c9dd9e30f7f656de1eabba, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < de75857ce374671712e1d9528844e3c0543dcef6, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 392c985c6b03dfdf4904c0d464f18735ca3c4df8, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 1e16e82581521a2fe20eda29bdc9e75286f7c950, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < c73cb5b7c159246dd572277c668851a56e516019, 2.6.12 | a9435a1f14a6f9520452617343ea59bb35ba9e79, 793163e134028e7136c9dd9e30f7f656de1eabba, de75857ce374671712e1d9528844e3c0543dcef6, 392c985c6b03dfdf4904c0d464f18735ca3c4df8, 1e16e82581521a2fe20eda29bdc9e75286f7c950, c73cb5b7c159246dd572277c668851a56e516019 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.