CVE-2026-53192

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Fix UAF at snd_timer_user_params()

At releasing a timer object, e.g. when a userspace timer

(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it

tries to detach the timer instances and release the resources.

However, it's still possible that other in-flight tasks are holding

the timer instance where the to-be-deleted timer object is associated,

and this may lead to racy accesses.

Fortunately, most of ioctls dealing with the timer instance list

already have the protection with register_mutex, and this also avoids

such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the

concurrent ioctl may lead to use-after-free.

This patch just adds the guard with register_mutex to protect

snd_timer_user_params() for covering the code path as a quick

workaround. It's no hot-path but rather a rarely issued ioctl, so the

performance penalty doesn't matter.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References