HIGH Introduced in 2.6.12
sound MtpavTimer UAF
CVE-2026-90116
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown snd_mtpav_output_timer() rearms chip->timer while holding chip->spinlock and accesses the card-private mtpav state. snd_mtpav_free() currently takes the same lock and calls timer_delete() when the timer is active. This only removes a pending timer; it does not wait for a callback that is already running and does not prevent the callback from rearming the timer. A callback running on another CPU can therefore continue after snd_mtpav_free() releases the lock and access the card-private state while the card is being torn down. It can also rearm the timer after timer_delete() has returned. Call timer_shutdown_sync() without holding chip->spinlock. This waits for any running callback to finish and prevents further rearming before the card-private mtpav state is released.
02KernelScan AI Analysis
Risk summary
A race condition in the ALSA mtpav MIDI driver allows a timer callback to continue accessing card-private data after the card teardown path has released its lock, resulting in a use-after-free. A local user with access to the audio device can trigger MIDI output to arm the timer; if the card is subsequently torn down (e.g., module unload or device removal), the still-running callback accesses freed memory. This can lead to kernel memory corruption, information disclosure, or a system crash.
Vulnerability analysis
The mtpav MIDI driver's output timer callback can continue running on another CPU after the card teardown path releases its spinlock, accessing card-private data that is being freed. The teardown path only deletes the pending timer without waiting for a callback already in progress, and the callback can rearm the timer after deletion, extending the race window. The fix replaces the non-blocking timer deletion with a synchronous shutdown call that waits for any running callback to finish and prevents further rearming before the card's private data is released. This vulnerability is reachable by a local user who can access the audio device to trigger MIDI output (arming the timer); the race fires when the card is subsequently torn down, which requires the mtpav module to be loaded on a system with MOTU MIDI Timepiece AV hardware.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 2.6.12 | 7.2.6 | 1e16e8258152 |
| 6.18 | 2.6.12 | 6.18.52 | 392c985c6b03 |
| mainline | 2.6.12 | 7.3-rc1 | c73cb5b7c159 |