CVE-2026-53192
Received Received - Intake
Use-After-Free in Linux Kernel ALSA Timer

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53192
EUVD
EUVD-2026-39283
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's ALSA timer subsystem. When a userspace timer object is released, the kernel tries to detach timer instances and free resources. However, if other tasks are still accessing the timer instance concurrently, a race condition can occur.

Most ioctls related to the timer instance list are protected by a mutex (register_mutex), preventing such races. But the SNDRV_TIMER_IOCTL_PARAMS ioctl is not protected, which can lead to a use-after-free (UAF) condition when accessed concurrently.

The fix adds a mutex guard to protect snd_timer_user_params(), preventing concurrent access and eliminating the race condition.

Impact Analysis

This use-after-free vulnerability could potentially lead to undefined behavior such as kernel crashes or memory corruption if exploited.

Since it involves kernel timer objects, an attacker with access to issue the vulnerable ioctl could cause system instability or denial of service by triggering the race condition.

Mitigation Strategies

The vulnerability is fixed by adding a mutex guard to protect the snd_timer_user_params() function in the Linux kernel ALSA timer code.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Since the issue involves a use-after-free in the ALSA timer ioctl handling, avoiding use of the SNDRV_TIMER_IOCTL_PARAMS ioctl until the patch is applied can reduce risk.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart