CVE-2026-90116

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ALSA mtpav component where the snd mtpav output timer() function rearms the chip->timer while holding the chip->spinlock and accesses card-private mtpav state. The snd mtpav free() function calls timer delete() while holding the same lock, which only removes pending timers but does not wait for active callbacks to finish or prevent them from rearming the timer. Consequently, a callback executing on another CPU may access the card-private state during teardown or rearm the timer after timer delete() has returned.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.