UBUNTU-CVE-2026-68201

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...

UBUNTU-CVE-2026-68202

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queuedelete closes the queue timer, then frees it. sndseqtimerclose clears q-timer-timeri. snduselocksync then drains borrowers, and sndseqtimerdelete frees q-timer. A...

EUVD-2026-55447

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41getacpimutestate evaluates a DSM method to get the ACPI mute state and reads the first byte from the returned object. However, the returned ACPI object is owned by the...

CVE-2026-68346 ALSA: hda: cs35l41: validate and free ACPI mute object

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41getacpimutestate evaluates a DSM method to get the ACPI mute state and reads the first byte from the returned object. However, the returned ACPI object is owned by the...

CVE-2026-68202 ALSA: seq: close a re-opened queue timer in the destructor

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queuedelete closes the queue timer, then frees it. sndseqtimerclose clears q-timer-timeri. snduselocksync then drains borrowers, and sndseqtimerdelete frees q-timer. A...

CVE-2026-68202 ALSA: seq: close a re-opened queue timer in the destructor

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queuedelete closes the queue timer, then frees it. sndseqtimerclose clears q-timer-timeri. snduselocksync then drains borrowers, and sndseqtimerdelete frees q-timer. A...

CVE-2026-68202

CVE-2026-68202 affects the Linux kernel’s ALSA sequencer. A race in queue timer cleanup allows an unprivileged local user with access to /dev/snd/seq to re-open a timer that has just been closed, leading to a use-after-free of the timer/queue object and a potential crash or, in theory, arbitrary ...

EUVD-2026-55302

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...

CVE-2026-68201

The CVE-2026-68201 issue affects the Linux kernel ALSA timer: when closing a master timer, a slave’s in-flight callback may run after detach, causing use-after-free. The fix drains slave callbacks before removing slave links, and stops pending/active callbacks on the slave side before freeing. Th...

CVE-2026-68201 ALSA: timer: drain a slave's callback before its master detaches it

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...

EUVD-2026-55301

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

CVE-2026-68200

The CVE-2026-68200 issue affects the Linux kernel ALSA timer component. The userspace-driven timer (utimer) TRIGGER ioctl can cause two threads to call snd_timer_interrupt() concurrently on the same timer due to missing serialization. In snd_timer_process_callbacks(), the code drops timer->loc...

CVE-2026-68200 ALSA: timer: don't re-enter an instance callback that is still running

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ALSA: mixer: OSS: Add card disconnect checkpoints The ALSA OSS mixer layer calls the kcontrol ops rather individually, and pending calls might not always be detected when the device is disconnected. To avoid potential UAF...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: A buffer overflow has been fixed in the configuration retrieval process. The scarlett2usbgetconfig function contains a logical error in the endianness conversion code, which can lead to buffer overflows when coun...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97 – fixed a double-free in sndac97controllerregister. If ac97addadapter fails, putdevice is the correct way to release the device reference. kfree is not required. Add kfree if idralloc fails, and also in...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Added a sanity check for OOB writes during silencing. During silencing, the playback URB packets are processed in the implicit fb mode before actual playback. We assume blindly that the received packets fit withi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed a NULL pointer dereference in sndusbmixercontrolsbadd In sndusbcreatestreams, for UAC version 3 devices, the Interface Association Descriptor IAD is retrieved via usbifnumtoif. If this call fails, a fallbac...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fixed a use-after-free in sndusbmixerfree When sndusbcreatemixer fails, sndusbmixerfree frees mixer-idelems, but the controls that were previously added to the card still reference the freed memory. Later, when...

Astra Linux – Vulnerability in alsa-lib

Versions of alsa-lib from 1.2.2 up to and including 1.2.15.2, prior to the release of 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplgdecodecontrolmixer1 function reads the numchannels field from untrusted .tplg data and uses it as a loop bound without...