CVE-2026-68200

The vulnerability is a use-after-free in the ALSA timer subsystem (CVE-2026-68200) where concurrent callback execution can occur when two threads trigger the same userspace timer via the utimer TRIGGER ioctl. The root cause is a mismatch between the SNDRV_TIMER_IFLG_CALLBACK flag's design and the concurrency model actually in play: the flag was intended as a binary 'callback running / not running' signal for hardware interrupt contexts where concurrent invocations are structurally impossible, but the utimer path exposes snd_timer_interrupt() to userspace threads where that invariant does not hold. The patch addresses the UAF by skipping re-queue when the callback flag is already set, effectively dropping the duplicate event rather than allowing the second callback to run while the first is still in flight. This resolves the memory safety issue but makes a semantic trade-off: accumulated pticks are delivered on the next callback rather than firing both callbacks at their distinct times. For audio sampling timers where consumers care about aggregate tick counts, this likely preserves functional correctness. However, sequencer queue consumers may have different expectations—they may require discrete timing markers with preserved ordering rather than merged deltas. Verify whether any timers in your environment bind to the sequencer queue path and whether those applications depend on per-callback ordering. From a defensive posture, check whether any processes genuinely need the utimer TRIGGER interface; if not, consider disabling it or restricting access. The /dev/snd/timer device is widely accessible with no capability gating, so the blast radius includes any local user with audio device access. The vulnerability becomes exploitable the moment a malicious local user can open the timer device and trigger concurrent TRIGGER ioctls—either from multiple threads within one process or across processes if sequencer bindings permit cross-instance interference. Monitor for processes unexpectedly opening /dev/snd/timer, particularly in low-privilege contexts. The underlying issue reflects a recurring kernel pattern: single-flag state tracking for callback-in-flight, which has manifested in other timer subsystems (POSIX timers, timerfd) with similar accumulated-ticks fixes. This suggests the fix resolves the immediate CVE but the architectural simplification persists across the codebase. If you're maintaining code with similar callback lifecycle patterns, treat this as a signal to review whether a single flag adequately represents your concurrency model.

Reviewed through automated stages and approved by a human before publication.