Look up another CVE · open CVE-2026-53192 in the interactive tracker
CVE-2026-53192
ALSA: timer: Fix UAF at snd_timer_user_params()
Published 2026-06-25 (4 months ago) by the Linux kernel CNA. Subsystem sound/core. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-53192 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.13-1 | Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
sound/core/timer.c
- What this is
- SOUNDMAINTAINERS section matched on sound/ · linux-sound@vger.kernel.org · Maintained
- Kernel module
- snd_timer
Check it on the machine
grep -wE 'CONFIG_SND|CONFIG_SND_TIMER' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w snd_timerPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_SND, CONFIG_SND_TIMER
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-06-25 (4 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 2.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- sound/core
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.12 | 6.12.94 | 38034d04d4a7 |
| 6.12 | 6.18.36 | 3d39da65b5c4 |
| 6.12 | 7.0.13 | 306427adf9b9 |
| 6.12 | 7.1 | 053a401b592b |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable path is reached through local `/dev/snd/timer` ioctls, specifically `SNDRV_TIMER_IOCTL_PARAMS`, after selecting a userspace-driven ALSA timer. It is not reachable by remote network input.
- AC:LAttack complexity, low
- The attacker can create the userspace-driven timer, select it, and race the params ioctl against closing the returned timer fd using their own threads or processes. No external victim state or uncontrollable timing condition is required beyond an attacker-controlled race.
- PR:LPrivileges required, low
- The kernel path has no capability or admin check, but exploitation requires local access to the ALSA timer device as a basic local user. It does not require real root or init-namespace capabilities.
- UI:NUser interaction, none
- No victim action is required after the attacker has local execution and device access. The attacker can open the timer device, issue ioctls, and close fds directly.
- S:UScope, unchanged
- The impact is within the same kernel security authority. This is a standard local kernel memory corruption issue, not a VM escape or cross-scope boundary violation.
- C:HConfidentiality impact, high
- The bug is a use-after-free of a kernel timer object reachable from a user-controlled race. Kernel UAFs can be leveraged for information disclosure through heap reuse and memory manipulation.
- I:HIntegrity impact, high
- The stale timer pointer is subsequently dereferenced and used for locking/state decisions, making this kernel heap UAF plausibly exploitable for memory corruption and privilege escalation. Under the required overestimation rule, integrity impact is High.
- A:HAvailability impact, high
- Even without full exploitation, the UAF can dereference or lock freed kernel memory and crash or hang the kernel. Repeated local triggering can therefore cause high availability impact.