{"id":25525,"date":"2026-09-18T04:31:30","date_gmt":"2026-09-17T20:31:30","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90116"},"modified":"2026-09-18T04:31:30","modified_gmt":"2026-09-17T20:31:30","slug":"cve-2026-90116","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90116","title":{"rendered":"CVE-2026-90116 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: mtpav: shut dow"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ALSA: mtpav: shut down output timer before card teardown<\/p>\n<p>snd_mtpav_output_timer() rearms chip-&gt;timer while holding<br \/>\nchip-&gt;spinlock and accesses the card-private mtpav state.<\/p>\n<p>snd_mtpav_free() currently takes the same lock and calls<br \/>\ntimer_delete() when the timer is active. This only removes a<br \/>\npending timer; it does not wait for a callback that is already<br \/>\nrunning and does not prevent the callback from rearming the timer.<\/p>\n<p>A callback running on another CPU can therefore continue after<br \/>\nsnd_mtpav_free() releases the lock and access the card-private<br \/>\nstate while the card is being torn down. It can also rearm the<br \/>\ntimer after timer_delete() has returned.<\/p>\n<p>Call timer_shutdown_sync() without holding chip-&gt;spinlock. This<br \/>\nwaits for any running callback to finish and prevents further<br \/>\nrearming before the card-private mtpav state is released.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ALSA: mtpav: shut down output timer before card teardown<\/p>\n<p>snd_mtpav_output_timer() rearms chip-&gt;timer while holding<br \/>\nchip-&gt;spinlock <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25525","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}