The flaw resides in the ALSA timer subsystem of the Linux kernel. When a user‑space thread issues a TRIGGER ioctl on a timer, the kernel function snd_timer_interrupt() is called directly without serialization. If two threads trigger the same timer concurrently, snd_timer_interrupt() can be executed simultaneously on the same timer instance. Each callback is marked by a SNDRV_TIMER_IFLG_CALLBACK flag, but the flag cannot represent two concurrent callbacks. When a second interrupt re‑queues a timer whose callback is still running, both callbacks execute at once; the first callback clears the flag after finishing, causing a close‑path drain that frees the instance while the second callback is still active. This race results in a use‑after‑free that any user with access to /dev/snd/timer or a sequencer queue timer can trigger. The CVE description does not document a kernel panic or code execution, only the possibility of undefined behavior from the freed object.

All Linux kernel builds that include the ALSA timer driver before the recent fix. The affected code path is present in kernel configurations that enable ALSA timer support; no specific version ranges are listed, so any kernel revision containing the buggy code is potentially vulnerable.

The CVSS score of 7.8 reflects the severity of a local use‑after‑free. The EPSS score of < 1% indicates a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, providing no evidence of widespread exploitation. Successful exploitation requires a local attacker with permission to open /dev/snd/timer. The lack of known exploitation examples suggests the overall risk remains moderate until a patch is applied.