{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53193","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-06-09T07:44:35.390Z","datePublished":"2026-06-25T08:39:04.346Z","dateUpdated":"2026-08-05T12:33:59.686Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:33:59.686Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Forcibly close timer instances at closing\n\nWhen snd_timer object is freed via snd_timer_free() and still pending\nsnd_timer_instance objects are assigned to the timer object, it tries\nto unlink all instances and just set NULL to each ti->timer, then\nreleases the resources immediately.  The problem is, however, when\nthere are slave timer instances that are associated with a master\ninstance linked to this timer: namely, those slave instances still\npoint to the freed timer object although the master instance is\nunlinked, which may lead to user-after-free.  The bug can be easily\ntriggered particularly when a new userspace-driven timers\n(CONFIG_SND_UTIMER) is involved, since it can create and delete the\ntimer object via a simple file open/close, while the other\napplications may keep accessing to that timer.\n\nThis patch is an attempt to paper over the problem above: now instead\nof just unlinking, call snd_timer_close[_locked]() forcibly for each\npending timer instance, so that all assigned slave timer instances are\nproperly detached, too.  Since snd_timer_close() might be called later\nby the driver that created that instance, the check of\nSNDRV_TIMER_IFLG_DEAD is added at the beginning, too."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local `/dev/snd/timer` opens and ALSA timer ioctls, including `SNDRV_TIMER_IOCTL_CREATE`, `SELECT`, and later access to retained timer instances.\nAC:L - The attacker can create the userspace-driven timer, bind matching master/slave timer instances, close the timer fd to free the object, and then access the stale slave instance without relying on uncontrollable conditions.\nPR:L - The code path has no capability checks, but it requires a local user able to open `/dev/snd/timer` and issue ioctls.\nUI:N - No victim action is required after the attacker has local access; the attacker controls all needed file descriptors and ioctls.\nS:U - The impact is within the kernel/local system security authority and does not cross a VM, IOMMU, or other separate security boundary.\nC:H - This is a kernel use-after-free of `struct snd_timer`; stale timer pointers can be dereferenced by later ioctls and may expose reclaimed kernel heap contents or enable broader memory disclosure.\nI:H - The stale timer pointer is used in paths that take locks and manipulate lists/callback-related state, making kernel heap corruption and control-flow-impacting exploitation defensible.\nA:H - At minimum, dereferencing and locking a freed kernel timer object can trigger a kernel oops, panic, or hang."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/core/timer.c"],"versions":[{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","lessThan":"586b219a22b1032b28b8bd356b963276c5e5bf53","status":"affected","versionType":"git"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","lessThan":"f46093dd22969037beb1fce2e043f3236be41c92","status":"affected","versionType":"git"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","lessThan":"60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f","status":"affected","versionType":"git"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","lessThan":"da3039e91d1f835874ed6e9a33ea19ee80c2cb92","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/core/timer.c"],"versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","status":"unaffected","versionType":"semver"},{"version":"6.12.94","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.36","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.13","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.18.36"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"7.0.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/586b219a22b1032b28b8bd356b963276c5e5bf53"},{"url":"https://git.kernel.org/stable/c/f46093dd22969037beb1fce2e043f3236be41c92"},{"url":"https://git.kernel.org/stable/c/60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f"},{"url":"https://git.kernel.org/stable/c/da3039e91d1f835874ed6e9a33ea19ee80c2cb92"}],"title":"ALSA: timer: Forcibly close timer instances at closing","x_generator":{"engine":"bippy-1.2.0"}}}}