CVE-2026-68200

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. A lack of serialization in the userspace-driven timer (utimer) TRIGGER ioctl allows two threads to concurrently call snd_timer_interrupt(). This race condition can lead to a use-after-free vulnerability, where a timer instance is freed while its callback is still running. A local attacker with the ability to open /dev/snd/timer could exploit this to achieve privilege escalation.

This vulnerability is rated as Important because an authenticated local user with access to sound subsystem interfaces can trigger a kernel race condition, potentially leading to root privilege escalation or denial of service. In standard Red Hat Enterprise Linux server environments, sound hardware is rarely configured, limiting general exposure, though systems running desktop environments or granting audio device access to logged-in sessions remain susceptible. Because exploitation requires direct interaction with the local ALSA timer device node, remote unauthenticated attacks are not possible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.