The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ALSA: mtpav: shut down output timer before card teardown snd_mtpav_output_timer() rearms chip->timer while     holding chip->spinlock and accesses the card-private mtpav state. snd_mtpav_free() currently takes the     same lock and calls timer_delete() when the timer is active. This only removes a pending timer; it does     not wait for a callback that is already running and does not prevent the callback from rearming the timer.
    A callback running on another CPU can therefore continue after snd_mtpav_free() releases the lock and     access the card-private state while the card is being torn down. It can also rearm the timer after     timer_delete() has returned. Call timer_shutdown_sync() without holding chip->spinlock. This waits for any     running callback to finish and prevents further rearming before the card-private mtpav state is released.
    (CVE-2026-90116)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-90116

low Nessus Plugin ID 347427

Version 1.5