CVE-2026-68200

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ALSA timer component. The userspace-driven timer (utimer) TRIGGER ioctl calls the snd timer interrupt() function without serialization, allowing two threads to execute snd timer interrupt() on a single snd timer concurrently. Because the SNDRV TIMER IFLG CALLBACK bit cannot track multiple concurrent callbacks, a second interrupt may re-queue an instance while its callback is still running. If the first callback finishes and clears the bit, the snd timer close locked() function may free the instance and its callback data while the second callback is still active. This is reachable by any user capable of opening /dev/snd/timer via a user timer instance or a sequencer queue timer bound to the utimer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.