CVE-2026-68200

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: don't re-enter an instance callback that is still running

The userspace-driven timer (utimer) TRIGGER ioctl calls

snd_timer_interrupt() directly with no serialization, so two threads

triggering the same utimer can run snd_timer_interrupt() on one

snd_timer concurrently.

snd_timer_process_callbacks() drops timer->lock around each instance

callback and marks the in-flight callback with the single

SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that

bit to drain an in-flight callback before freeing the instance. The bit

cannot represent two concurrent callbacks: when a second interrupt

re-queues an instance whose callback is still running, both run at once,

the first to finish clears the bit, and the close-path drain then frees

the instance (and its callback_data) while the other callback is still

live - a use-after-free reachable by any user able to open

/dev/snd/timer, both via a user ti

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References