CVE-2026-68202

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: close a re-opened queue timer in the destructor

queue_delete() closes the queue timer, then frees it. snd_seq_timer_close()

clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and

snd_seq_timer_delete() frees q->timer.

A borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT

that took a queueptr() use_lock reference before the queue was unlinked

runs snd_seq_timer_open() after the close. Open refuses re-open only while

timeri is set, and the close just cleared it, so it re-opens timeri.

snd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop()

is a no-op, because running was cleared first. So it frees q->timer with the

instance still live. The queue is freed next.

The instance stays on the global timer with callback_data pointing at the

freed queue. A non-owner START on the unlocked queue arms it. The next tick

derefs the freed queue in snd_seq_timer_in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References