CVE-2026-68201

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: timer: drain a slave&amp;#39;s callback before its master detaches it<br /> <br /> snd_timer_close_locked() drains the closing instance&amp;#39;s own in-flight<br /> callback (IFLG_CALLBACK) before freeing it, but not its slaves&amp;#39;. When a<br /> master instance is closed, remove_slave_links() clears each slave&amp;#39;s<br /> -&gt;timer; the slave&amp;#39;s own close then reads timer == NULL and takes the<br /> branch that skips the drain entirely (snd_timer_stop_slave() also no-ops<br /> on a NULL timer). So a slave whose callback is still running when the<br /> master is closed is freed underneath the live callback, leading to<br /> use-after-free.<br /> <br /> Drain the slaves too before remove_slave_links() severs them.<br /> snd_timer_stop() has already taken this instance off the active list, so<br /> no new slave callback can be queued. Take the slaves off the ack list so<br /> a pending one can&amp;#39;t fire either, then wait for any that is already in<br /> flight.