CVE-2026-68202

This is a use-after-free in the ALSA sequencer queue timer subsystem, but its mechanics are more insidious than a typical dangling pointer. The vulnerability stems from a race between the timer destructor and the queueptr() borrower mechanism: when a queue is deleted, the code clears q->timer before fully closing the timer instance, but queueptr() borrowers can re-open the timer during this window, resurrecting a timer instance whose callback still points to freed queue memory. The callback snd_seq_timer_interrupt() continues reading q->timer after the close begins — that's the invariant the patch enforces by moving snd_timer_close() before q->timer is nulled, allowing the close operation to wait for in-flight interrupts to complete. The exploitation profile is concerning: no CAP_SYS_RESOURCE, no queue ownership required, just access to /dev/snd/seq. An unprivileged user with audio access can trigger the race. More critically, this isn't a transient race window — the queue remains registered in the global timer subsystem, armed and ticking, with callback_data pointing at freed memory. Each timer interrupt re-triggers the dereference until the system crashes or the freed page gets reallocated with attacker-controlled data. That's a stable exploitation primitive with repeated attempts, and the corruption propagates upward through snd_seq_check_queue() into the sequencer event pipeline for all clients, not just the owning process. Check your kernel versions. The fix is a single close-before-clear ordering change in the destructor path, but the real question is whether your audio stack runs untrusted clients. If you host multi-user audio environments or shared audio infrastructure, prioritize this patch. Monitor for sporadic audio subsystem crashes correlating with sequencer activity — the bug manifests as reliable crashes on audio use rather than intermittent mysterious failures, which often gets misclassified as a stability issue. The subsystem (ALSA sequencer queue timers) is low-visibility code that hasn't seen active development in years, meaning similar latent patterns may exist elsewhere in the audio stack.

Reviewed through automated stages and approved by a human before publication.