CVE-2026-68200

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: timer: don&amp;#39;t re-enter an instance callback that is still running<br /> <br /> The userspace-driven timer (utimer) TRIGGER ioctl calls<br /> snd_timer_interrupt() directly with no serialization, so two threads<br /> triggering the same utimer can run snd_timer_interrupt() on one<br /> snd_timer concurrently.<br /> <br /> snd_timer_process_callbacks() drops timer-&gt;lock around each instance<br /> callback and marks the in-flight callback with the single<br /> SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that<br /> bit to drain an in-flight callback before freeing the instance. The bit<br /> cannot represent two concurrent callbacks: when a second interrupt<br /> re-queues an instance whose callback is still running, both run at once,<br /> the first to finish clears the bit, and the close-path drain then frees<br /> the instance (and its callback_data) while the other callback is still<br /> live - a use-after-free reachable by any user able to open<br /> /dev/snd/timer, both via a user timer instance and via a sequencer queue<br /> timer bound to the utimer.<br /> <br /> snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer-&gt;lock, so<br /> a concurrent interrupt already observes it under the lock. Skip<br /> re-queuing an instance (and its slaves) to the ack/sack list while its<br /> callback is in flight; the accumulated pticks are delivered on the next<br /> tick, so no event is lost.