CVE-2026-68202

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) sequencer component. An unprivileged local user with access to the sound device can exploit a timing window during the cleanup of a queue timer. This allows the user to re-open a timer that has already been closed, leading to a use-after-free vulnerability. This can result in a system crash (denial of service) or potentially lead to arbitrary code execution.

A use-after-free in the ALSA sequencer queue timer path can leave a live timer instance whose callback_data still points to a freed queue. During queue_delete(), snd_seq_timer_close() clears timeri before all outstanding use_lock borrowers have drained. A concurrent SET_QUEUE_CLIENT operation that already holds a queue reference can therefore re-open the timer in this window. The destructor subsequently frees q->timer and the queue without closing the re-opened timer instance, leaving it attached to the global timer with a dangling reference to the freed queue. A later non-owner START can arm the lingering timer instance, and the next timer tick dereferences the freed queue in snd_seq_timer_interrupt().

For CVSS, PR:L is appropriate because the vulnerable path is directly reachable by an unprivileged local user with access to /dev/snd/seq; no capabilities and no queue ownership are required. The issue is not remotely or network reachable and requires local access to the ALSA sequencer interface. AC:H is appropriate because successful exploitation depends on winning a race between queue destruction and timer re-opening.

Successful exploitation can at minimum cause a kernel crash and local denial of service. Because the resulting condition is a kernel use-after-free involving a live callback to a freed object, reuse or manipulation of the freed memory may also allow confidentiality or integrity impact and potentially privilege escalation or arbitrary code execution, although exploitation beyond denial of service has not been demonstrated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module snd_seq from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.