--- id: CVE-2026-53192 title: |- In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g summary: |- In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-416 - CWE-364 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 6.12, < 6.12.94' - 'linux_kernel >= 6.13, < 6.18.36' - 'linux_kernel >= 6.19, < 7.0.13' - linux_kernel = 7.1 patched: - linux_kernel 7.0.13 published: '2026-06-25' updated: '2026-10-15' sourceUpdated: '2026-10-15T02:20:03.933' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53192' references: - url: 'https://git.kernel.org/stable/c/053a401b592be424fea9d57c789f66cd5d8cec11' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/306427adf9b97e29e5958cb9cf3096c6151fc9ff' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/38034d04d4a75bbca01df2b313ced0bcd0fa3242' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/3d39da65b5c422c5e5afb7d5651b0698d060a827' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53192.json - url: 'https://access.redhat.com/security/cve/CVE-2026-53192' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492792' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-53192' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53192' - url: >- https://lore.kernel.org/linux-cve-announce/2026062558-CVE-2026-53192-5b6e@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:68507' - url: 'https://access.redhat.com/errata/RHSA-2026:68570' - url: 'https://access.redhat.com/errata/RHSA-2026:68531' - url: 'https://access.redhat.com/errata/RHSA-2026:68532' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.00097 epssPercentile: 0.00718 scores: nvd: 7.8 vendor: 7 cna: 7.8 ingestedAt: '2026-06-29T13:42:12.001Z' ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-16T15:26:35.656798Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. ## Affected - `linux_kernel >= 6.12, < 6.12.94` - `linux_kernel >= 6.13, < 6.18.36` - `linux_kernel >= 6.19, < 7.0.13` - `linux_kernel = 7.1` ## Remediation Upgrade past the affected range: - `linux_kernel 7.0.13` ## Vendor advisories - **RHSA-2026:68507** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68507) - **RHSA-2026:68570** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68570) - **RHSA-2026:68531** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68531) - **RHSA-2026:68532** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68532) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53192.json)