CVE-2026-68202

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ALSA sequencer where a queue timer can be re-opened during the destruction process. When queue delete() is called, it closes the queue timer and subsequently frees it. However, a borrower can re-open the timer via snd seq timer open() after the close operation has cleared q->timer->timeri but before the queue is fully deleted. Because snd seq timer delete() does not close this new instance, the q->timer is freed while the instance remains live on the global timer. This leads to a use-after-free scenario where snd seq timer interrupt() dereferences the freed queue. This can be triggered by an unprivileged user with access to /dev/snd/seq without requiring specific capabilities or queue ownership.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.