The defect occurs in the ALSA timer subsystem of the Linux kernel. When a master timer instance closes, its closing function drains the master’s own callback but not those of its slave instances. The slave instance, still running a callback when the master detaches it, is freed while the callback continues, causing a use‑after‑free. In kernel space this can corrupt kernel memory or allow execution of arbitrary code with elevated privileges.

The vulnerability is confined to the Linux operating system. No specific kernel versions are listed in the advisory; therefore, any kernel build containing the ALSA timer code before the patch that introduces commit 2b298997 (and related commits) is potentially affected. Users of recent kernel releases should verify that the patch has been incorporated into their current kernel version.

The CVSS score is not provided and EPSS is unavailable, and the flaw is not listed in CISA’s KEV catalog, indicating no widespread exploitation to date. Nevertheless, a use‑after‑free in a privileged context is severe, providing local privilege escalation or remote code execution if the attacker can trigger ALSA timer operations, such as through a malicious user‑space program or compromised process. No public exploit is known, but the risk remains high, and the flaw should be treated with urgency.