CVE-2026-98314

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem. A race condition during audio timer registration allows a new timer to become accessible to other processes before its internal data is initialized. A local user can exploit this vulnerability by concurrently accessing the timer interface, triggering a NULL-pointer dereference. This flaw results in a kernel crash, leading to a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because successful exploitation requires local authenticated access and winning a precise race condition, with the blast radius confined to an operating system crash. In typical Red Hat Enterprise Linux server environments, audio hardware and services are rarely utilized, significantly limiting exposure. On systems where sound components are active, an unprivileged local user could induce a denial of service by triggering the uninitialized timer dereference, though arbitrary code execution and information disclosure are not possible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.