--- id: CVE-2026-53192 title: |- In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g summary: |- In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' published: '2026-06-25' updated: '2026-06-29' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53192' references: - url: 'https://git.kernel.org/stable/c/053a401b592be424fea9d57c789f66cd5d8cec11' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/306427adf9b97e29e5958cb9cf3096c6151fc9ff' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/38034d04d4a75bbca01df2b313ced0bcd0fa3242' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/3d39da65b5c422c5e5afb7d5651b0698d060a827' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53192.json - url: 'https://access.redhat.com/security/cve/CVE-2026-53192' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492792' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-53192' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53192' - url: >- https://lore.kernel.org/linux-cve-announce/2026062558-CVE-2026-53192-5b6e@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:68507' - url: 'https://access.redhat.com/errata/RHSA-2026:68570' - url: 'https://access.redhat.com/errata/RHSA-2026:68531' - url: 'https://access.redhat.com/errata/RHSA-2026:68532' tags: - nvd - csaf - vex - red-hat epss: 0.00125 epssPercentile: 0.02541 ingestedAt: '2026-06-29T13:42:12.001Z' vendor: Red Hat product: Red Hat Enterprise Linux BaseOS (v. 10) affected: - enterprise_linux 7 - enterprise_linux 9 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_v_10 - enterprise_linux_crb_v_8 - enterprise_linux_codeready_linux_builder_v_9 - enterprise_linux_real_time_for_nfv_v_10 - enterprise_linux_nfv_v_8 - enterprise_linux_real_time_for_nfv_v_9 - enterprise_linux_real_time_v_10 - enterprise_linux_rt_v_8 - enterprise_linux_real_time_v_9 patched: - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_v_10 - enterprise_linux_crb_v_8 - enterprise_linux_codeready_linux_builder_v_9 - enterprise_linux_real_time_for_nfv_v_10 - enterprise_linux_nfv_v_8 - enterprise_linux_real_time_for_nfv_v_9 - enterprise_linux_real_time_v_10 - enterprise_linux_rt_v_8 - enterprise_linux_real_time_v_9 cwe: - CWE-364 scores: nvd: 7.8 vendor: 7 --- ## Overview In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:68507** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68507) - **RHSA-2026:68570** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68570) - **RHSA-2026:68531** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68531) - **RHSA-2026:68532** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68532) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53192.json)