CVE-2026-98314 ALSA: pcm: set timer->private_data before registering the PCM timer

What is CVE-2026-98314?

CVE-2026-98314 is a vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: set timer->private_data before registering the PCM timer

snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream.

Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference:

substream = timer->private_data; return substream->runtime ? ... // substream is NULL

Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe.

Which versions are affected by CVE-2026-98314?

How do I fix CVE-2026-98314?

Apply the vendor's patch.

Is CVE-2026-98314 being exploited?

There is no known exploitation of CVE-2026-98314 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-106380, BELL-CVE-2026-98314, DEBIAN-CVE-2026-98314, GHSA-f958-2rwj-98rc, UBUNTU-CVE-2026-98314.