The vulnerability lies in the ALSA timer subsystem of the Linux kernel. When a userspace thread issues a TRIGGER ioctl on a timer, the kernel calls snd_timer_interrupt() directly without serializing the operation. Consequently, two threads can trigger the same timer concurrently, causing snd_timer_interrupt() to run twice on the same timer instance. Each callback is marked by a SNDRV_TIMER_IFLG_CALLBACK flag, but the flag cannot represent two concurrent callbacks. If a second interrupt re‑queues a timer while its callback is still running, both callbacks execute simultaneously. The first callback clears the flag, allowing snd_timer_close_locked() to free the instance while the second callback is still active, resulting in a use‑after‑free that can be triggered by any user who can open /dev/snd/timer or a sequencer queue timer bound to the utimer.

All Linux kernel builds that include the ALSA timer driver before the recent fix are potentially vulnerable. Any kernel revision containing the buggy code path—present in configurations enabling ALSA timer support—should be considered at risk. No specific version numbers are provided, so the vulnerability applies broadly to affected kernels regardless of release.

The CVSS score of 7.8 reflects a local use‑after‑free with a moderate risk of exploitation. The EPSS score of < 1% indicates a very low current probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local attacker who has permission to open /dev/snd/timer, and the vulnerability can be triggered by any user able to do so. Because no exploitation examples are documented, the overall risk is considered moderate until the patch is applied.