This defect occurs in the ALSA timer subsystem of the Linux kernel. Two user‑space threads can trigger the same timer at the same time, causing snd_timer_interrupt() to run concurrently. The callback state flag is set before releasing the lock, so a second interrupt that re‑queues an instance while the callback is still executing clears the flag after the first callback finishes, resulting in a scenario where the callback data is freed while still in use. A local user that can open /dev/snd/timer, or a sequencer queue bound to the utimer, can exercise this race condition. The reuse of freed memory can cause a kernel panic or potentially allow the user to exploit the freed object for arbitrary code execution, effectively providing local privilege escalation or denial‑of‑service.

All Linux kernel builds that include the ALSA timer driver before the fix, regardless of distribution. The specific kernel version ranges are not listed, so any kernel revision that contains the buggy code without the commit that introduces the serialization guard is affected.

The CVSS score is not available in the public data, and the EPSS score is not reported. The vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited in the wild. A successful exploitation requires local access to the system and the ability to open /dev/snd/timer. Because the race can lead to a use‑after‑free, the potential impact is high; however, the lack of available exploitation evidence keeps the overall risk moderate until the kernel is updated.