The ALSA timer code in the Linux kernel marks a timer instance with a DEAD flag upon close but fails to clear it after removal from internal lists. If the instance is reopened before the flag is cleared, the close routine returns early and the instance is freed while still linked to kernel structures. Subsequent operations such as snd_timer_open, snd_timer_check_slave, or reading /proc/asound/timers can dereference the stale instance, leading to a kernel fault. An attacker with local access to /dev/snd/timer and /dev/snd/seq can trigger the open‑close sequence that produces the state, causing a kernel crash. The description does not suggest any privilege escalation outcome, only that the crash results in a denial of service.

All Linux kernels containing the unpatched ALSA timer implementation are vulnerable. The fix is part of the core kernel, so any distribution not yet updated to the branch that clears the DEAD flag after removal is affected. The vulnerability is not limited to a single kernel version but applies to any kernel built before the code change referenced by commit 0c561fab5.

The vulnerability's exploitation results in a kernel crash, causing denial of service to the local system. The CVSS score of 7.8 classifies this as high severity. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. An unprivileged user who can read/write /dev/snd/timer and /dev/snd/seq can provoke the sequence that triggers the crash. The CVE payload does not mention any publicly disclosed exploits. Although no escalation is documented, the crash could be leveraged by a malicious user to disrupt system operation.