CVE-2026-68200

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached purely through local syscalls: opening /dev/snd/timer, the SNDRV_TIMER_IOCTL_CREATE ioctl to obtain a utimer fd, and concurrent SNDRV_TIMER_IOCTL_TRIGGER ioctls on that fd. No network or physical access is involved.

AC:LAttack complexity, low

The attacker owns every side of the race: two of its own threads issue the TRIGGER ioctls that run snd_timer_interrupt() concurrently, while a third closes the timer instance, and the ioctl can be spammed in a tight loop until the window is hit. Nothing depends on conditions outside attacker control.

PR:LPrivileges required, low

Only the ability to open /dev/snd/timer is needed, which any member of the audio group, any logged-in desktop session (granted via logind ACLs), or any Android media/app process has. No capabilities, no root, and the commit explicitly states it is reachable by "any user able to open /dev/snd/timer".

UI:NUser interaction, none

The attacking process creates the utimer, triggers it from its own threads, and closes the instance entirely on its own. No victim action, no filesystem mount, and no privileged helper participation is required.

S:UScope, unchanged

The use-after-free corrupts kernel slab memory in the same security authority as the attacked kernel; there is no VM, IOMMU, or sandbox boundary crossed by the freed snd_timer_instance or its callback_data.

C:HConfidentiality impact, high

The freed snd_timer_instance and its callback_data (snd_timer_user with its event ring buffer, or snd_seq_queue) are re-read by the still-running callback after being reallocated, so an attacker who heap-sprays the slot can turn the dangling read/queue-append into disclosure of arbitrary reallocated kernel memory back through the timer read() interface.

I:HIntegrity impact, high

The live callback (snd_timer_user_tinterrupt/ccallback or the sequencer queue tick handler) keeps writing into the freed object - event queue indices, pointers, and spinlock state - giving a controlled write into attacker-groomed slab contents, a classic UAF primitive leveragable for control-flow hijack and privilege escalation.

A:HAvailability impact, high

Even without successful grooming, the concurrent callback touches freed memory and manipulates list heads of a destroyed instance, producing list corruption, KASAN splats, and kernel oops or panic; the ioctl can be re-run repeatedly to crash the machine at will.