CVE-2026-53193

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. This vulnerability occurs when a timer object is freed while timer instances are still associated with it, particularly when userspace-driven timers are involved. A local user can exploit this by repeatedly creating and deleting timer objects, leading to a use-after-free condition. This can result in system instability or denial of service.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local authenticated access with specific timing conditions to trigger the race condition and use-after-free flaw. Standard Red Hat server installations do not typically expose ALSA audio interfaces or utilize userspace-driven timers for unprivileged tasks, which significantly limits practical attack surfaces. An attacker with local system access could exploit orphaned timer slave references to induce a kernel crash or potentially elevate privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.