---
id: CVE-2026-53193
title: 'ALSA: timer: Forcibly close timer instances at closing'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: timer: Forcibly close timer instances at closing

  When snd_timer object is freed via snd_timer_free() and still pending
  snd_timer_instance objects are assigned to…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 <
    586b219a22b1032b28b8bd356b963276c5e5bf53
  - >-
    Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 <
    f46093dd22969037beb1fce2e043f3236be41c92
  - >-
    Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 <
    60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f
  - >-
    Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 <
    da3039e91d1f835874ed6e9a33ea19ee80c2cb92
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:26:37.858700Z'
published: '2026-06-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:39.378Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53193'
references:
  - url: 'https://git.kernel.org/stable/c/586b219a22b1032b28b8bd356b963276c5e5bf53'
  - url: 'https://git.kernel.org/stable/c/f46093dd22969037beb1fce2e043f3236be41c92'
  - url: 'https://git.kernel.org/stable/c/60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f'
  - url: 'https://git.kernel.org/stable/c/da3039e91d1f835874ed6e9a33ea19ee80c2cb92'
tags:
  - cve.org
epss: 0.00141
epssPercentile: 0.03062
ingestedAt: '2026-10-16T17:24:46.735Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Forcibly close timer instances at closing

When snd_timer object is freed via snd_timer_free() and still pending
snd_timer_instance objects are assigned to the timer object, it tries
to unlink all instances and just set NULL to each ti->timer, then
releases the resources immediately.  The problem is, however, when
there are slave timer instances that are associated with a master
instance linked to this timer: namely, those slave instances still
point to the freed timer object although the master instance is
unlinked, which may lead to user-after-free.  The bug can be easily
triggered particularly when a new userspace-driven timers
(CONFIG_SND_UTIMER) is involved, since it can create and delete the
timer object via a simple file open/close, while the other
applications may keep accessing to that timer.

This patch is an attempt to paper over the problem above: now instead
of just unlinking, call snd_timer_close[_locked]() forcibly for each
pending timer instance, so that all assigned slave timer instances are
properly detached, too.  Since snd_timer_close() might be called later
by the driver that created that instance, the check of
SNDRV_TIMER_IFLG_DEAD is added at the beginning, too.

## Affected

- `Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 < 586b219a22b1032b28b8bd356b963276c5e5bf53`
- `Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 < f46093dd22969037beb1fce2e043f3236be41c92`
- `Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 < 60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f`
- `Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 < da3039e91d1f835874ed6e9a33ea19ee80c2cb92`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.