CVE-2026-98314: Linux kernel · ALSA: pcm: set timer->private_data before registering the PCM timer
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 28 Oct 2026, 01:27 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer->private_data before registering the PCM timer snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream. Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference: substream = timer->private_data; return substream->runtime ? ... // substream is NULL Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe.
References
- ubuntu.com/security/CVE-2026-98314 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-98314 (opens in a new tab)
- git.kernel.org/linus/1e713f9bb2ac583521f06b0eb4e22440b1e3d078 (opens in a new tab)
- git.kernel.org/stable/c/0b349249d572633d7c8cdeb917623d1676a2b7c3 (opens in a new tab)
- git.kernel.org/stable/c/1e713f9bb2ac583521f06b0eb4e22440b1e3d078 (opens in a new tab)
- git.kernel.org/stable/c/27f167e117eca310661fbcbacb352ea08face067 (opens in a new tab)
- git.kernel.org/stable/c/555d168bd98daa46daccc68c908201388c834293 (opens in a new tab)
- git.kernel.org/stable/c/686c7a6af1eea8d2a919303e4c6bbec3de79dbdc (opens in a new tab)
- git.kernel.org/stable/c/8c869d5cf5affb20994bdbb60e7d46d65c91b55f (opens in a new tab)
- git.kernel.org/stable/c/d63f5a9f8121fb43c798056d7dd34c58f47185d7 (opens in a new tab)
- git.kernel.org/stable/c/e1eee8f16628f8b6bcae0a366fd6a2dd65e71edd (opens in a new tab)