When the ALSA timer device is freed in the kernel while slave timer instances remain, the free operation leaves those slave instances pointing to a deallocated timer object. This user‑after‑free condition can corrupt kernel memory and cause a crash or, in a worst case, enable an attacker to execute code in privileged context. The defect originates in the ALSA timer subsystem when snd_timer_free() unlinks instances without properly detaching slaves. The applied patch forces a close of any pending instances‑flag check, preventing dangling references.

All Linux kernel releases that include the ALSA timer driver with CONFIG_SND_UTIMER enabled are affected. The vulnerability affects the ALSA timer subsystem regardless of distribution, as the underlying CPE identifies the generic Linux kernel. Versions prior to the patch commit that introduced the forced close are vulnerable.

Because the flaw is a classic use‑after‑free, exploitation requires an application that creates ALSA timers from userspace (e.g., via CONFIG_SND_UTIMER) and then deletes the timer while other processes continue to reference it. No EPSS data is available, and the vulnerability is not yet listed in CISA KEV. The likely attack vector is userspace interactions with ALSA timers, inferred from the description, making the risk high if the kernel is not updated and the timer subsystem is exposed.