CVE-2026-90116

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: mtpav: shut down output timer before card teardown

snd_mtpav_output_timer() rearms chip->timer while holding

chip->spinlock and accesses the card-private mtpav state.

snd_mtpav_free() currently takes the same lock and calls

timer_delete() when the timer is active. This only removes a

pending timer; it does not wait for a callback that is already

running and does not prevent the callback from rearming the timer.

A callback running on another CPU can therefore continue after

snd_mtpav_free() releases the lock and access the card-private

state while the card is being torn down. It can also rearm the

timer after timer_delete() has returned.

Call timer_shutdown_sync() without holding chip->spinlock. This

waits for any running callback to finish and prevents further

rearming before the card-private mtpav state is released.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References