Executive brief
A vulnerability was identified in the Linux kernel's sound subsystem (ALSA) that could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when certain audio timers are closed, leaving behind references to memory that has already been freed. This flaw is particularly relevant for systems using userspace-driven timers, where simple file operations could trigger the error.
Technical details
A use-after-free (UAF) vulnerability exists in sound/core/timer.c within the Linux kernel. When a snd_timer object is freed via snd_timer_free(), the kernel attempts to unlink all associated instances; however, slave timer instances associated with a master instance may still maintain pointers to the freed timer object. This is easily triggered when CONFIG_SND_UTIMER is enabled, as userspace can create and delete timer objects through file operations while other applications are still accessing them. The fix involves forcibly calling snd_timer_close_locked() for all pending instances to ensure proper detachment of slave timers. Patches have been merged into multiple stable branches including 6.12.y, 6.18.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.12, 6.18, 7.0, 7.1
Timeline
- 2026-06-06: disclosed: Initial patch submitted by Takashi Iwai
- 2026-06-25: advisory: CVE-2026-53193 published