{"id":"CVE-2026-53193","revision":"e7dbc61d872c4919b009ea20aab4aef0","records":[{"revision":"e7dbc61d872c4919b009ea20aab4aef0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53193","aliases":[],"title":"ALSA: timer: Forcibly close timer instances at closing","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Forcibly close timer instances at closing\n\nWhen snd_timer object is freed via snd_timer_free() and still pending\nsnd_timer_instance objects are assigned to the timer object, it tries\nto unlink all instances and just set NULL to each ti->timer, then\nreleases the resources immediately.  The problem is, however, when\nthere are slave timer instances that are associated with a master\ninstance linked to this timer: namely, those slave instances still\npoint to the freed timer object although the master instance is\nunlinked, which may lead to user-after-free.  The bug can be easily\ntriggered particularly when a new userspace-driven timers\n(CONFIG_SND_UTIMER) is involved, since it can create and delete the\ntimer object via a simple file open/close, while the other\napplications may keep accessing to that timer.\n\nThis patch is an attempt to paper over the problem above: now instead\nof just unlinking, call snd_timer_close[_locked]() forcibly for each\npending timer instance, so that all assigned slave timer instances are\nproperly detached, too.  Since snd_timer_close() might be called later\nby the driver that created that instance, the check of\nSNDRV_TIMER_IFLG_DEAD is added at the beginning, too.","state":0,"publishedAt":"2026-06-25T08:39:04.346+00:00","modifiedAt":"2026-10-19T19:57:27.947+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/core/timer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"37745918e0e7575bc40f38da93a99b9fa6406224\",\n                            \"lessThan\": \"586b219a22b1032b28b8bd356b963276c5e5bf53\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"37745918e0e7575bc40f38da93a99b9fa6406224\",\n                            \"lessThan\": \"f46093dd22969037beb1fce2e043f3236be41c92\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"37745918e0e7575bc40f38da93a99b9fa6406224\",\n                            \"lessThan\": \"60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"37745918e0e7575bc40f38da93a99b9fa6406224\",\n                            \"lessThan\": \"da3039e91d1f835874ed6e9a33ea19ee80c2cb92\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/core/timer.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.94\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.36\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.13\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/586b219a22b1032b28b8bd356b963276c5e5bf53","https://git.kernel.org/stable/c/f46093dd22969037beb1fce2e043f3236be41c92","https://git.kernel.org/stable/c/60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f","https://git.kernel.org/stable/c/da3039e91d1f835874ed6e9a33ea19ee80c2cb92"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53193","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53193","identifiers":["CVE-2026-53193"]},"retained":false,"historicalAffected":[]}],"coverage":[]}