CVE-2026-90116

A flaw was found in the ALSA mtpav driver of the Linux kernel. A race condition exists where the output timer callback can continue to access card-private state after the card has been torn down. This occurs because the timer deletion mechanism does not wait for a running callback to finish, allowing it to rearm the timer or access freed memory. This can lead to memory corruption and system instability, potentially resulting in a denial of service.

A race condition flaw of moderate impact was found in the ALSA mtpav driver of the Linux kernel, which affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 7 through 10, the kernels in Red Hat In-Vehicle OS, and the RHEL CoreOS kernels used by OpenShift Container Platform 4. The snd_mtpav_output_timer() callback rearms chip->timer while holding chip->spinlock and accesses card-private mtpav state, but snd_mtpav_free() relies on timer_delete(), which only removes a pending timer: it does not wait for a callback already running on another CPU and does not prevent that callback from rearming the timer. A timer callback can therefore continue to access card-private state while the card is being torn down, and can rearm the timer after timer_delete() has returned, leading to memory corruption and system instability, potentially resulting in a denial of service. Exploitation requires local access to the system and triggering teardown of the mtpav device while its output timer is active; the impact is limited to availability, with no confidentiality or integrity impact (Red Hat CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, Moderate). The fix is currently deferred for the affected Red Hat product streams; the residual risk is that a local user could trigger this race to corrupt kernel memory or crash the system. The Red Hat Enterprise Linux 6 ELS stream is out of support scope for this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.