CVE-2026-53192

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Fix UAF at snd_timer_user_params()

At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, its still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses.

Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isnt protected, hence the concurrent ioctl may lead to use-after-free.

This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. Its no hot-path but rather a rarely issued ioctl, so the performance penalty doesnt matter.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/053a401b592be424fea9d57c789f66cd5d8cec11
• https://git.kernel.org/stable/c/306427adf9b97e29e5958cb9cf3096c6151fc9ff
• https://git.kernel.org/stable/c/38034d04d4a75bbca01df2b313ced0bcd0fa3242
• https://git.kernel.org/stable/c/3d39da65b5c422c5e5afb7d5651b0698d060a827