In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tries to unlink all instances and just set NULL to each ti->timer, then releases the resources immediately. The problem is, however, when there are slave timer instances that are associated with a master instance linked to this timer: namely, those slave instances still point to the freed timer object although the master instance is unlinked, which may lead to user-after-free. The bug can be easily triggered particularly when a new userspace-driven timers (CONFIG_SND_UTIMER) is involved, since it can create and delete the timer object via a simple file open/close, while the other applications may keep accessing to that timer. This patch is an attempt to paper over the problem above: now instead of just unlinking, call snd_timer_close[_locked]() forcibly for each pending timer instance, so that all assigned slave timer instances are properly detached, too. Since snd_timer_close() might be called later by the driver that created that instance, the check of SNDRV_TIMER_IFLG_DEAD is added at the beginning, too.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free()     and still pending snd_timer_instance objects are assigned to the timer object, it tries to unlink all     instances and just set NULL to each ti->timer, then releases the resources immediately. The problem is,     however, when there are slave timer instances that are associated with a master instance linked to this     timer: namely, those slave instances still point to the freed timer object although the master instance is     unlinked, which may lead to user-after-free. The bug can be easily triggered particularly when a new     userspace-driven timers (CONFIG_SND_UTIMER) is involved, since it can create and delete the timer object     via a simple file open/close, while the other applications may keep accessing to that timer. This patch is     an attempt to paper over the problem above: now instead of just unlinking, call snd_timer_close[_locked]()     forcibly for each pending timer instance, so that all assigned slave timer instances are properly     detached, too. Since snd_timer_close() might be called later by the driver that created that instance, the     check of SNDRV_TIMER_IFLG_DEAD is added at the beginning, too. (CVE-2026-53193)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
335080	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21555-1)	Nessus	SuSE Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
323429	Linux Distros Unpatched Vulnerability : CVE-2026-53193	Nessus	Misc.	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-53193

high

Tenable Plugins

high

high

high

high

high