CVE-2026-68200 (GCVE-0-2026-68200)
Vulnerability from cvelistv5
Published
2026-08-10 12:00
Modified
2026-08-17 05:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: don't re-enter an instance callback that is still running
The userspace-driven timer (utimer) TRIGGER ioctl calls
snd_timer_interrupt() directly with no serialization, so two threads
triggering the same utimer can run snd_timer_interrupt() on one
snd_timer concurrently.
snd_timer_process_callbacks() drops timer->lock around each instance
callback and marks the in-flight callback with the single
SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that
bit to drain an in-flight callback before freeing the instance. The bit
cannot represent two concurrent callbacks: when a second interrupt
re-queues an instance whose callback is still running, both run at once,
the first to finish clears the bit, and the close-path drain then frees
the instance (and its callback_data) while the other callback is still
live - a use-after-free reachable by any user able to open
/dev/snd/timer, both via a user timer instance and via a sequencer queue
timer bound to the utimer.
snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so
a concurrent interrupt already observes it under the lock. Skip
re-queuing an instance (and its slaves) to the ack/sack list while its
callback is in flight; the accumulated pticks are delivered on the next
tick, so no event is lost.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "996c24377eea4d4506b7c3ccbbf1e490440b5e0b",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
},
{
"lessThan": "1395327a96614885552bae5fbb650e6dd182d49b",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
},
{
"lessThan": "c1078130a4cd7e738f4b73afe99b3e68cbfbf884",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
},
{
"lessThan": "70d28bfcd6224eed75986b3b987b997e59643fa4",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: don\u0027t re-enter an instance callback that is still running\n\nThe userspace-driven timer (utimer) TRIGGER ioctl calls\nsnd_timer_interrupt() directly with no serialization, so two threads\ntriggering the same utimer can run snd_timer_interrupt() on one\nsnd_timer concurrently.\n\nsnd_timer_process_callbacks() drops timer-\u003elock around each instance\ncallback and marks the in-flight callback with the single\nSNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that\nbit to drain an in-flight callback before freeing the instance. The bit\ncannot represent two concurrent callbacks: when a second interrupt\nre-queues an instance whose callback is still running, both run at once,\nthe first to finish clears the bit, and the close-path drain then frees\nthe instance (and its callback_data) while the other callback is still\nlive - a use-after-free reachable by any user able to open\n/dev/snd/timer, both via a user timer instance and via a sequencer queue\ntimer bound to the utimer.\n\nsnd_timer_interrupt() sets IFLG_CALLBACK before dropping timer-\u003elock, so\na concurrent interrupt already observes it under the lock. Skip\nre-queuing an instance (and its slaves) to the ack/sack list while its\ncallback is in flight; the accumulated pticks are delivered on the next\ntick, so no event is lost."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached purely through local syscalls: opening /dev/snd/timer, the SNDRV_TIMER_IOCTL_CREATE ioctl to obtain a utimer fd, and concurrent SNDRV_TIMER_IOCTL_TRIGGER ioctls on that fd. No network or physical access is involved.\nAC:L - The attacker owns every side of the race: two of its own threads issue the TRIGGER ioctls that run snd_timer_interrupt() concurrently, while a third closes the timer instance, and the ioctl can be spammed in a tight loop until the window is hit. Nothing depends on conditions outside attacker control.\nPR:L - Only the ability to open /dev/snd/timer is needed, which any member of the audio group, any logged-in desktop session (granted via logind ACLs), or any Android media/app process has. No capabilities, no root, and the commit explicitly states it is reachable by \"any user able to open /dev/snd/timer\".\nUI:N - The attacking process creates the utimer, triggers it from its own threads, and closes the instance entirely on its own. No victim action, no filesystem mount, and no privileged helper participation is required.\nS:U - The use-after-free corrupts kernel slab memory in the same security authority as the attacked kernel; there is no VM, IOMMU, or sandbox boundary crossed by the freed snd_timer_instance or its callback_data.\nC:H - The freed snd_timer_instance and its callback_data (snd_timer_user with its event ring buffer, or snd_seq_queue) are re-read by the still-running callback after being reallocated, so an attacker who heap-sprays the slot can turn the dangling read/queue-append into disclosure of arbitrary reallocated kernel memory back through the timer read() interface.\nI:H - The live callback (snd_timer_user_tinterrupt/ccallback or the sequencer queue tick handler) keeps writing into the freed object - event queue indices, pointers, and spinlock state - giving a controlled write into attacker-groomed slab contents, a classic UAF primitive leveragable for control-flow hijack and privilege escalation.\nA:H - Even without successful grooming, the concurrent callback touches freed memory and manipulates list heads of a destroyed instance, producing list corruption, KASAN splats, and kernel oops or panic; the ioctl can be re-run repeatedly to crash the machine at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:00:43.695Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/996c24377eea4d4506b7c3ccbbf1e490440b5e0b"
},
{
"url": "https://git.kernel.org/stable/c/1395327a96614885552bae5fbb650e6dd182d49b"
},
{
"url": "https://git.kernel.org/stable/c/c1078130a4cd7e738f4b73afe99b3e68cbfbf884"
},
{
"url": "https://git.kernel.org/stable/c/70d28bfcd6224eed75986b3b987b997e59643fa4"
}
],
"title": "ALSA: timer: don\u0027t re-enter an instance callback that is still running",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68200",
"datePublished": "2026-08-10T12:00:19.253Z",
"dateReserved": "2026-07-30T09:28:09.374Z",
"dateUpdated": "2026-08-17T05:00:43.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…