CVE-2026-53193

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: timer: Forcibly close timer instances at closing<br /> <br /> When snd_timer object is freed via snd_timer_free() and still pending<br /> snd_timer_instance objects are assigned to the timer object, it tries<br /> to unlink all instances and just set NULL to each ti-&gt;timer, then<br /> releases the resources immediately. The problem is, however, when<br /> there are slave timer instances that are associated with a master<br /> instance linked to this timer: namely, those slave instances still<br /> point to the freed timer object although the master instance is<br /> unlinked, which may lead to user-after-free. The bug can be easily<br /> triggered particularly when a new userspace-driven timers<br /> (CONFIG_SND_UTIMER) is involved, since it can create and delete the<br /> timer object via a simple file open/close, while the other<br /> applications may keep accessing to that timer.<br /> <br /> This patch is an attempt to paper over the problem above: now instead<br /> of just unlinking, call snd_timer_close[_locked]() forcibly for each<br /> pending timer instance, so that all assigned slave timer instances are<br /> properly detached, too. Since snd_timer_close() might be called later<br /> by the driver that created that instance, the check of<br /> SNDRV_TIMER_IFLG_DEAD is added at the beginning, too.