CVE-2026-90116 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: mtpav: shut down output timer before card teardown
snd_mtpav_output_timer() rearms chip->timer while holding chip->spinlock and accesses the card-private mtpav state.
snd_mtpav_free() currently takes the same lock and calls timer_delete() when the timer is active. This only removes a pending timer; it does not wait for a callback that is already running and does not prevent the callback from rearming the timer.
A callback running on another CPU can therefore continue after snd_mtpav_free() releases the lock and access the card-private state while the card is being torn down. It can also rearm the timer after timer_delete() has returned.
Call timer_shutdown_sync() without holding chip->spinlock. This waits for any running callback to finish and prevents further rearming before the card-private mtpav state is released.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's Advanced Linux Sound Architecture (ALSA) subsystem contains a concurrency vulnerability within the MTPAV sound driver, specifically involving improper synchronization during device teardown operations. The core issue stems from how the output timer callback and the free function interact with shared card-private state protected by chip spinlocks. When snd_mtpav_output_timer is executed, it rearms the hardware timer while holding the chip spinlock to access private data structures. Conversely, when the driver attempts to release resources via snd_mtpav_free, it acquires the same lock and invokes timer_delete to stop pending timers. However, this approach fails to account for asynchronous execution contexts where a timer callback may already be executing on a different CPU core at the moment deletion is requested.
This architectural flaw creates a race condition that leads to use-after-free vulnerabilities and potential kernel crashes or data corruption. Specifically, calling timer_delete only removes future invocations of the timer but does not block currently running callbacks from completing their execution. Consequently, after snd_mtpav_free releases the spinlock, an active callback thread on another processor can continue executing code that accesses card-private state which is subsequently deallocated during teardown. Furthermore, because the lock is released before the callback finishes, there exists a window where the timer might be rearmed by the running callback even after timer_delete has returned success, leading to further access of freed memory regions in subsequent executions.
From a security and stability perspective, this vulnerability represents a classic race condition that can result in arbitrary code execution or denial of service depending on how the corrupted state is exploited. The lack of proper synchronization between resource deallocation and asynchronous callback completion violates fundamental principles of safe concurrent programming within kernel space. This aligns with Common Weakness Enumeration CWE-362, which describes concurrent access resulting in race conditions, as well as CWE-416 regarding use after free scenarios where memory is accessed after it has been freed. In the context of the MITRE ATT&CK framework for enterprise security, this type of vulnerability could potentially be leveraged during post-exploitation phases to escalate privileges or maintain persistence through kernel-level instability if an attacker can trigger specific timing conditions that exploit the race window between timer deletion and callback completion.
To mitigate this risk, the resolution involves replacing the standard timer deletion mechanism with a more robust synchronization primitive known as timer_shutdown_sync. This function is called without holding the chip spinlock to avoid deadlocks while ensuring that any currently executing callbacks are allowed to complete before proceeding. Crucially, timer_shutdown_sync waits for all running instances of the callback to finish and prevents further rearming of the timer until it is explicitly restarted by new initialization code. By decoupling the shutdown process from the lock held during normal operation, this fix ensures that no thread can access freed card-private state after teardown has begun. This approach guarantees memory safety by synchronizing the lifecycle of hardware timers with driver resource management, thereby eliminating the race condition and preventing potential exploitation vectors associated with asynchronous timer callbacks in high-concurrency environments.