CVE-2026-68200: ALSA: timer: don't re-enter an instance callback that is still running

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: don't re-enter an instance callback that is still running

The userspace-driven timer (utimer) TRIGGER ioctl calls
snd_timer_interrupt() directly with no serialization, so two threads
triggering the same utimer can run snd_timer_interrupt() on one
snd_timer concurrently.

snd_timer_process_callbacks() drops timer->lock around each instance
callback and marks the in-flight callback with the single
SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that
bit to drain an in-flight callback before freeing the instance. The bit
cannot represent two concurrent callbacks: when a second interrupt
re-queues an instance whose callback is still running, both run at once,
the first to finish clears the bit, and the close-path drain then frees
the instance (and its callback_data) while the other callback is still
live - a use-after-free reachable by any user able to open
/dev/snd/timer, both via a user timer instance and via a sequencer queue
timer bound to the utimer.

snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so
a concurrent interrupt already observes it under the lock. Skip
re-queuing an instance (and its slaves) to the ack/sack list while its
callback is in flight; the accumulated pticks are delivered on the next
tick, so no event is lost.

The Linux kernel CVE team has assigned CVE-2026-68200 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 37745918e0e7575bc40f38da93a99b9fa6406224 and fixed in 6.12.101 with commit 996c24377eea4d4506b7c3ccbbf1e490440b5e0b
	Issue introduced in 6.12 with commit 37745918e0e7575bc40f38da93a99b9fa6406224 and fixed in 6.18.42 with commit 1395327a96614885552bae5fbb650e6dd182d49b
	Issue introduced in 6.12 with commit 37745918e0e7575bc40f38da93a99b9fa6406224 and fixed in 7.1.6 with commit c1078130a4cd7e738f4b73afe99b3e68cbfbf884
	Issue introduced in 6.12 with commit 37745918e0e7575bc40f38da93a99b9fa6406224 and fixed in 7.2-rc5 with commit 70d28bfcd6224eed75986b3b987b997e59643fa4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68200
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/core/timer.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/996c24377eea4d4506b7c3ccbbf1e490440b5e0b
	https://git.kernel.org/stable/c/1395327a96614885552bae5fbb650e6dd182d49b
	https://git.kernel.org/stable/c/c1078130a4cd7e738f4b73afe99b3e68cbfbf884
	https://git.kernel.org/stable/c/70d28bfcd6224eed75986b3b987b997e59643fa4