CVE-2026-68200
Received Received - Intake

Linux Kernel Use-After-Free in ALSA Timer

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads triggering the same utimer can run snd_timer_interrupt() on one snd_timer concurrently. snd_timer_process_callbacks() drops timer->lock around each instance callback and marks the in-flight callback with the single SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that bit to drain an in-flight callback before freeing the instance. The bit cannot represent two concurrent callbacks: when a second interrupt re-queues an instance whose callback is still running, both run at once, the first to finish clears the bit, and the close-path drain then frees the instance (and its callback_data) while the other callback is still live - a use-after-free reachable by any user able to open /dev/snd/timer, both via a user timer instance and via a sequencer queue timer bound to the utimer. snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so a concurrent interrupt already observes it under the lock. Skip re-queuing an instance (and its slaves) to the ack/sack list while its callback is in flight; the accumulated pticks are delivered on the next tick, so no event is lost.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68200
EUVD
EUVD-2026-55301

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's ALSA timer subsystem. It occurs when two threads trigger the same user timer simultaneously, causing snd_timer_interrupt() to run concurrently on one snd_timer instance. The issue arises because the callback tracking bit (SNDRV_TIMER_IFLG_CALLBACK) cannot represent two concurrent callbacks, leading to a situation where one callback finishes and clears the bit while another is still running. This allows the timer instance to be freed while a callback is still active, creating a use-after-free condition accessible to any user with access to /dev/snd/timer.

Detection Guidance

This vulnerability affects the Linux kernel's ALSA timer subsystem. Detection requires checking kernel versions and ALSA timer usage. Inspect running kernel version with uname -a and check for ALSA timer device access via ls -l /dev/snd/timer. Monitor system logs for timer-related errors or crashes.

Impact Analysis

An attacker with local access could exploit this to execute arbitrary code in the kernel, escalate privileges, or cause a system crash (denial of service). Since the vulnerability is reachable via /dev/snd/timer, any user with basic permissions could trigger it, potentially compromising system integrity or confidentiality.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix. Restrict access to /dev/snd/timer by adjusting permissions or using SELinux/AppArmor policies. Disable unused ALSA timer instances if possible. Monitor for suspicious activity related to timer operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68200. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart