CVE-2026-53192

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53192", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.390Z", "datePublished": "2026-06-25T08:39:03.696Z", "dateUpdated": "2026-10-19T19:57:27.788Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:33:58.587Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Fix UAF at snd_timer_user_params()\n\nAt releasing a timer object, e.g. when a userspace timer\n(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it\ntries to detach the timer instances and release the resources.\nHowever, it's still possible that other in-flight tasks are holding\nthe timer instance where the to-be-deleted timer object is associated,\nand this may lead to racy accesses.\n\nFortunately, most of ioctls dealing with the timer instance list\nalready have the protection with register_mutex, and this also avoids\nsuch races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the\nconcurrent ioctl may lead to use-after-free.\n\nThis patch just adds the guard with register_mutex to protect\nsnd_timer_user_params() for covering the code path as a quick\nworkaround. It's no hot-path but rather a rarely issued ioctl, so the\nperformance penalty doesn't matter."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local `/dev/snd/timer` ioctls, specifically `SNDRV_TIMER_IOCTL_PARAMS`, after selecting a userspace-driven ALSA timer. It is not reachable by remote network input.\nAC:L - The attacker can create the userspace-driven timer, select it, and race the params ioctl against closing the returned timer fd using their own threads or processes. No external victim state or uncontrollable timing condition is required beyond an attacker-controlled race.\nPR:L - The kernel path has no capability or admin check, but exploitation requires local access to the ALSA timer device as a basic local user. It does not require real root or init-namespace capabilities.\nUI:N - No victim action is required after the attacker has local execution and device access. The attacker can open the timer device, issue ioctls, and close fds directly.\nS:U - The impact is within the same kernel security authority. This is a standard local kernel memory corruption issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a use-after-free of a kernel timer object reachable from a user-controlled race. Kernel UAFs can be leveraged for information disclosure through heap reuse and memory manipulation.\nI:H - The stale timer pointer is subsequently dereferenced and used for locking/state decisions, making this kernel heap UAF plausibly exploitable for memory corruption and privilege escalation. Under the required overestimation rule, integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or lock freed kernel memory and crash or hang the kernel. Repeated local triggering can therefore cause high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/timer.c"], "versions": [{"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "38034d04d4a75bbca01df2b313ced0bcd0fa3242", "status": "affected", "versionType": "git"}, {"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "3d39da65b5c422c5e5afb7d5651b0698d060a827", "status": "affected", "versionType": "git"}, {"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "306427adf9b97e29e5958cb9cf3096c6151fc9ff", "status": "affected", "versionType": "git"}, {"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "053a401b592be424fea9d57c789f66cd5d8cec11", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/timer.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/38034d04d4a75bbca01df2b313ced0bcd0fa3242"}, {"url": "https://git.kernel.org/stable/c/3d39da65b5c422c5e5afb7d5651b0698d060a827"}, {"url": "https://git.kernel.org/stable/c/306427adf9b97e29e5958cb9cf3096c6151fc9ff"}, {"url": "https://git.kernel.org/stable/c/053a401b592be424fea9d57c789f66cd5d8cec11"}], "title": "ALSA: timer: Fix UAF at snd_timer_user_params()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:22:38.165Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:26:35.656798Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:57:27.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:26:35.656798Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-10-16T15:26:36.260Z"}}], "cna": {"title": "ALSA: timer: Fix UAF at snd_timer_user_params()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local `/dev/snd/timer` ioctls, specifically `SNDRV_TIMER_IOCTL_PARAMS`, after selecting a userspace-driven ALSA timer. It is not reachable by remote network input.\nAC:L - The attacker can create the userspace-driven timer, select it, and race the params ioctl against closing the returned timer fd using their own threads or processes. No external victim state or uncontrollable timing condition is required beyond an attacker-controlled race.\nPR:L - The kernel path has no capability or admin check, but exploitation requires local access to the ALSA timer device as a basic local user. It does not require real root or init-namespace capabilities.\nUI:N - No victim action is required after the attacker has local execution and device access. The attacker can open the timer device, issue ioctls, and close fds directly.\nS:U - The impact is within the same kernel security authority. This is a standard local kernel memory corruption issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a use-after-free of a kernel timer object reachable from a user-controlled race. Kernel UAFs can be leveraged for information disclosure through heap reuse and memory manipulation.\nI:H - The stale timer pointer is subsequently dereferenced and used for locking/state decisions, making this kernel heap UAF plausibly exploitable for memory corruption and privilege escalation. Under the required overestimation rule, integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or lock freed kernel memory and crash or hang the kernel. Repeated local triggering can therefore cause high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "38034d04d4a75bbca01df2b313ced0bcd0fa3242", "versionType": "git"}, {"status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "3d39da65b5c422c5e5afb7d5651b0698d060a827", "versionType": "git"}, {"status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "306427adf9b97e29e5958cb9cf3096c6151fc9ff", "versionType": "git"}, {"status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "053a401b592be424fea9d57c789f66cd5d8cec11", "versionType": "git"}], "programFiles": ["sound/core/timer.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.94", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.36", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.13", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/core/timer.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/38034d04d4a75bbca01df2b313ced0bcd0fa3242"}, {"url": "https://git.kernel.org/stable/c/3d39da65b5c422c5e5afb7d5651b0698d060a827"}, {"url": "https://git.kernel.org/stable/c/306427adf9b97e29e5958cb9cf3096c6151fc9ff"}, {"url": "https://git.kernel.org/stable/c/053a401b592be424fea9d57c789f66cd5d8cec11"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Fix UAF at snd_timer_user_params()\n\nAt releasing a timer object, e.g. when a userspace timer\n(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it\ntries to detach the timer instances and release the resources.\nHowever, it's still possible that other in-flight tasks are holding\nthe timer instance where the to-be-deleted timer object is associated,\nand this may lead to racy accesses.\n\nFortunately, most of ioctls dealing with the timer instance list\nalready have the protection with register_mutex, and this also avoids\nsuch races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the\nconcurrent ioctl may lead to use-after-free.\n\nThis patch just adds the guard with register_mutex to protect\nsnd_timer_user_params() for covering the code path as a quick\nworkaround. It's no hot-path but rather a rarely issued ioctl, so the\nperformance penalty doesn't matter."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.94", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.36", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:33:58.587Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53192", "state": "PUBLISHED", "dateUpdated": "2026-10-15T01:22:38.165Z", "dateReserved": "2026-06-09T07:44:35.390Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-25T08:39:03.696Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/core/timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "38034d04d4a75bbca01df2b313ced0bcd0fa3242", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}, {"lessThan": "3d39da65b5c422c5e5afb7d5651b0698d060a827", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}, {"lessThan": "306427adf9b97e29e5958cb9cf3096c6151fc9ff", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}, {"lessThan": "053a401b592be424fea9d57c789f66cd5d8cec11", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/core/timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.94", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.36", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7327870E-8777-43EF-92CB-081E4B51D6F9", "versionEndExcluding": "6.12.94", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3", "versionEndExcluding": "6.18.36", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E", "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc7:*:*:*:*:*:*", "matchCriteriaId": "1039E95A-8CC3-4C88-8FF9-5C08EEB861C9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Fix UAF at snd_timer_user_params()\n\nAt releasing a timer object, e.g. when a userspace timer\n(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it\ntries to detach the timer instances and release the resources.\nHowever, it's still possible that other in-flight tasks are holding\nthe timer instance where the to-be-deleted timer object is associated,\nand this may lead to racy accesses.\n\nFortunately, most of ioctls dealing with the timer instance list\nalready have the protection with register_mutex, and this also avoids\nsuch races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the\nconcurrent ioctl may lead to use-after-free.\n\nThis patch just adds the guard with register_mutex to protect\nsnd_timer_user_params() for covering the code path as a quick\nworkaround. It's no hot-path but rather a rarely issued ioctl, so the\nperformance penalty doesn't matter."}], "id": "CVE-2026-53192", "lastModified": "2026-10-19T20:19:08.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53192", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:26:35.656798Z", "version": "2.0.3"}}]}, "published": "2026-06-25T09:16:36.637", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/053a401b592be424fea9d57c789f66cd5d8cec11"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/306427adf9b97e29e5958cb9cf3096c6151fc9ff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/38034d04d4a75bbca01df2b313ced0bcd0fa3242"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3d39da65b5c422c5e5afb7d5651b0698d060a827"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: ALSA: timer: Fix UAF at snd_timer_user_params()", "id": "2492792", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492792"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component. A race condition can occur during the release of a timer object, specifically when the SNDRV_TIMER_IOCTL_PARAMS ioctl is called concurrently. This can lead to a use-after-free vulnerability, potentially allowing a local attacker to achieve arbitrary code execution or cause a denial of service."], "name": "CVE-2026-53192", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53192\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53192\nhttps://lore.kernel.org/linux-cve-announce/2026062558-CVE-2026-53192-5b6e@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,92ad2d7f80cad43b046f093e808e11fe919d304a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,117743d62e1225e208568a3ffc2c07214f1347cb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b2214914e461d0466548a52dfe4f4ee8ce362276)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e2331730175f74169046d2af8db1b47243df7c7a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,38034d04d4a75bbca01df2b313ced0bcd0fa3242)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3d39da65b5c422c5e5afb7d5651b0698d060a827)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,306427adf9b97e29e5958cb9cf3096c6151fc9ff)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,053a401b592be424fea9d57c789f66cd5d8cec11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.10.259)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.15.210)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.1.176)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.143)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.94)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.36)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.13)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.259,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.94,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.13,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-25T11:00:11.395071+00:00", "updated": "2026-10-19T23:30:05.613930+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-364", "CWE-416"]}