In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer     (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and     release the resources. However, it's still possible that other in-flight tasks are holding the timer     instance where the to-be-deleted timer object is associated, and this may lead to racy accesses.
    Fortunately, most of ioctls dealing with the timer instance list already have the protection with     register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the     concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect     snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a     rarely issued ioctl, so the performance penalty doesn't matter. (CVE-2026-53192)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326306	Photon OS 4.0: Linux PHSA-2026-4.0-1054	Nessus	PhotonOS Local Security Checks	high
323389	Photon OS 5.0: Linux PHSA-2026-5.0-0904	Nessus	PhotonOS Local Security Checks	high
323370	Linux Distros Unpatched Vulnerability : CVE-2026-53192	Nessus	Misc.	high

Detections

Analytics

CVE-2026-53192

high

Tenable Plugins

high

high

high