An ALSA timer bug in the Linux kernel can cause a use-after-free when a user closes a timer object (CONFIG_SND_UTIMER) and another process concurrently invokes SNDRV_TIMER_IOCTL_PARAMS. This race allows a process to access freed kernel memory, potentially enabling arbitrary memory read/write or code execution. The weakness is a classic use-after-free flaw (CWE-364).

All Linux kernels that compile the ALSA subsystem with CONFIG_SND_UTIMER enabled are affected. The vulnerability exists in the timer handling code of the ALSA driver where the user-controlled ioctl SNDRV_TIMER_IOCTL_PARAMS was not protected by the register_mutex. No specific version range is provided, so any kernel with the unpatched ALSA timer code is vulnerable.

The EPSS score of <1% indicates a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The CVSS score of 7.0 reflects high severity. The presence of a use-after-free that can be triggered by a concurrent ioctl gives the potential for serious compromise if an attacker can run code with sufficient privileges or achieve a privilege-escalating condition. The likely attack vector is a local user or compromised process issuing the SNDRV_TIMER_IOCTL_PARAMS ioctl while another process closes a timer. The risk is moderate to high in ALSA timers are used.