The vulnerability resides within the ALSA sequencer subsystem of the Linux kernel. It involves a flaw in the timer deletion logic: when a queue is destroyed, the timer is closed and freed while a borrower can re‑open it in a narrow window. This allows a non‑privileged user to trigger a use‑after‑free, causing the kernel to dereference a freed queue during a timer interrupt. The consequence is a potential kernel crash, which can be leveraged for denial‑of‑service attacks.

All Linux kernels that contain the ALSA sequencer subsystem prior to the commit that added the destruction check. The vulnerability is reachable via the /dev/snd/seq device, so any system exposing that device to unprivileged users is affected.

The attacker requires only local access to /dev/snd/seq and no elevated privileges. While an official CVSS score is not listed, the use‑after‑free nature of the flaw and the lack of CAP requirements imply a high potential impact for a local attacker. No exploitation data is posted in CISA KEV, and no EPSS score is available; therefore the documented exploitation risk is uncertain but the flaw is still serious due to its kernel‑crash effect.