The vulnerability resides in the ALSA timer subsystem of the Linux kernel, where a master timer instance is closed while a slave’s callback is still executing. Because the master does not drain the slave’s callback before severing the link, the slave object is freed while its callback continues to run, resulting in a use‑after‑free. The flaw is classified as CWE‑825 and can lead to kernel memory corruption.

All Linux kernel builds that incorporate the ALSA timer code before the patch that introduces commit 2b298997 and associated commits are potentially affected. No explicit kernel version ranges are provided; therefore any kernel prior to the inclusion of the fix remains at risk. Users of recent releases should verify that the patch changes are present in their current kernel version.

The CVSS score is 7.8 and the EPSS score is below 1%, indicating a moderate severity with very low documented exploitation probability. The flaw is not listed in CISA’s KEV catalog. Because the use‑after‑free occurs in privileged kernel code, the likely attack vector is local: an attacker able to execute code in user space or otherwise interact with ALSA timer operations can trigger the flaw. No public exploits have been reported.