In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100758 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ALSA: timer: Fix UAF at snd_timer_user_params()

    At releasing a timer object, e.g. when a userspace timer     (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it     tries to detach the timer instances and release the resources.
    However, it's still possible that other in-flight tasks are holding     the timer instance where the to-be-deleted timer object is associated,     and this may lead to racy accesses.

    Fortunately, most of ioctls dealing with the timer instance list     already have the protection with register_mutex, and this also avoids     such races.  But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the     concurrent ioctl may lead to use-after-free.

    This patch just adds the guard with register_mutex to protect     snd_timer_user_params() for covering the code path as a quick     workaround.  It's no hot-path but rather a rarely issued ioctl, so the     performance penalty doesn't matter.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer     (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and     release the resources. However, it's still possible that other in-flight tasks are holding the timer     instance where the to-be-deleted timer object is associated, and this may lead to racy accesses.
    Fortunately, most of ioctls dealing with the timer instance list already have the protection with     register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the     concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect     snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a     rarely issued ioctl, so the performance penalty doesn't matter. (CVE-2026-53192)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
336979	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100758)	Nessus	Unity Linux Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
332436	Photon OS 5.0: Linux PHSA-2026-5.0-91-0904	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
329149	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3166-1)	Nessus	SuSE Local Security Checks	Local	medium
326306	Photon OS 4.0: Linux PHSA-2026-4.0-1054	Nessus	PhotonOS Local Security Checks	Local	high
323389	Photon OS 5.0: Linux PHSA-2026-5.0-0904	Nessus	PhotonOS Local Security Checks	Local	high
323370	Linux Distros Unpatched Vulnerability : CVE-2026-53192	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53192

high

Tenable Plugins

high

high

high

high

high

medium

high

high

high