Executive brief
The Linux kernel's ALSA audio driver for MIDI through parallel port (mtpav) devices contains a race condition during shutdown. A timer callback can continue running and access freed memory even after the device card is being torn down, potentially causing a system crash or memory corruption.
Technical details
This vulnerability is a use-after-free race condition in the mtpav ALSA driver's card teardown path. The snd_mtpav_output_timer() callback rearms the chip->timer while holding chip->spinlock and accesses card-private state. The vulnerable snd_mtpav_free() function calls timer_delete() under the same spinlock, but this only removes pending timers and does not wait for or prevent an already-running callback from continuing or rearming itself. A callback executing on another CPU can thus access the card-private mtpav state after snd_mtpav_free() releases the lock, during card teardown when that state is being freed. The fix calls timer_shutdown_sync() without holding the spinlock, which waits for running callbacks to complete and prevents rearming before card-private state is released.
Affected products
- Linux Linux kernel 2.6.12 and later
Timeline
- 2026-09-17: disclosed
- 2026-08-20: patched: Fix committed upstream