---
id: CVE-2026-68201
title: 'ALSA: timer: drain a slave''s callback before its master detaches it'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: timer: drain a slave's callback before its master detaches it

  snd_timer_close_locked() drains the closing instance's own in-flight
  callback (IFLG_CALLBACK) befor…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 <
    cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0
  - >-
    Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 <
    426c0ff1c433d6030610ad4f9375746dfe931caa
  - >-
    Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 <
    2b298997786876b225cff2446e11a0fa6f602f6d
  - >-
    Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 <
    bdefe1346a8e6b8dc8593406dc2617e985fcbcab
  - Linux 6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:45:48.460607Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:03.451Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68201'
references:
  - url: 'https://git.kernel.org/stable/c/cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0'
  - url: 'https://git.kernel.org/stable/c/426c0ff1c433d6030610ad4f9375746dfe931caa'
  - url: 'https://git.kernel.org/stable/c/2b298997786876b225cff2446e11a0fa6f602f6d'
  - url: 'https://git.kernel.org/stable/c/bdefe1346a8e6b8dc8593406dc2617e985fcbcab'
tags:
  - cve.org
epss: 0.0017
epssPercentile: 0.05977
ingestedAt: '2026-10-16T17:24:46.848Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: drain a slave's callback before its master detaches it

snd_timer_close_locked() drains the closing instance's own in-flight
callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a
master instance is closed, remove_slave_links() clears each slave's
->timer; the slave's own close then reads timer == NULL and takes the
branch that skips the drain entirely (snd_timer_stop_slave() also no-ops
on a NULL timer). So a slave whose callback is still running when the
master is closed is freed underneath the live callback, leading to
use-after-free.

Drain the slaves too before remove_slave_links() severs them.
snd_timer_stop() has already taken this instance off the active list, so
no new slave callback can be queued. Take the slaves off the ack list so
a pending one can't fire either, then wait for any that is already in
flight.

## Affected

- `Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 < cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0`
- `Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 < 426c0ff1c433d6030610ad4f9375746dfe931caa`
- `Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 < 2b298997786876b225cff2446e11a0fa6f602f6d`
- `Linux >= 37745918e0e7575bc40f38da93a99b9fa6406224 < bdefe1346a8e6b8dc8593406dc2617e985fcbcab`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.