CVE-2026-53192

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel ALSA Timer

Publication date: 2026-06-25

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-06

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53192

EUVD

EUVD-2026-39283

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.12 (inc) to 6.12.94 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Compliance Impact

The provided information does not specify any impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability exists in the Linux kernel's ALSA timer subsystem. When a userspace timer object is released, the kernel tries to detach timer instances and free resources. However, if other tasks are still accessing the timer instance concurrently, a race condition can occur.

Most ioctls related to the timer instance list are protected by a mutex (register_mutex), preventing such races. But the SNDRV_TIMER_IOCTL_PARAMS ioctl is not protected, which can lead to a use-after-free (UAF) condition when accessed concurrently.

The fix adds a mutex guard to protect snd_timer_user_params(), preventing concurrent access and eliminating the race condition.

Impact Analysis

This use-after-free vulnerability could potentially lead to undefined behavior such as kernel crashes or memory corruption if exploited.

Since it involves kernel timer objects, an attacker with access to issue the vulnerable ioctl could cause system instability or denial of service by triggering the race condition.

Mitigation Strategies

The vulnerability is fixed by adding a mutex guard to protect the snd_timer_user_params() function in the Linux kernel ALSA timer code.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Since the issue involves a use-after-free in the ALSA timer ioctl handling, avoiding use of the SNDRV_TIMER_IOCTL_PARAMS ioctl until the patch is applied can reduce risk.

Hi! I’m here to help you understand CVE-2026-53192. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70