CyberSecBulletin
CVE-2026-68202NVD status: Received

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-68202 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions b7feeaca1f53b10df9b4de9eaf611767ca70dc92, 7478ef94b49bc9789cf1a003deec58b42283dde4, 9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to b7feeaca1f53b10df9b4de9eaf611767ca70dc92 or 7478ef94b49bc9789cf1a003deec58b42283dde4 or 9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833 or fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, b7feeaca1f53b10df9b4de9eaf611767ca70dc92; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 7478ef94b49bc9789cf1a003deec58b42283dde4; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 24f0cabf173539f048946c8fc221131dc221f277; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 6a10025c7fd09a7d2af37a3ae1da188569fce470; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 31a6163e301d832060f8236f1ed17cbc1ca198df; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9; and 1 more rangesb7feeaca1f53b10df9b4de9eaf611767ca70dc92, 7478ef94b49bc9789cf1a003deec58b42283dde4, 9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833, fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07, 24f0cabf173539f048946c8fc221131dc221f277, 6a10025c7fd09a7d2af37a3ae1da188569fce470

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and snd_seq_timer_delete() frees q->timer. A borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT that took a queueptr() use_lock reference before the queue was unlinked runs snd_seq_timer_open() after the close. Open refuses re-open only while timeri is set, and the close just cleared it, so it re-opens timeri. snd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop() is a no-op, because running was cleared first. So it frees q->timer with the instance still live. The queue is freed next. The instance stays on the global timer with callback_data pointing at the freed queue. A non-owner START on the unlocked queue arms it. The next tick derefs the freed queue in snd_seq_timer_interrupt(). Reachable by an unprivileged user with access to /dev/snd/seq. No CAP and no queue ownership required. Close any lingering instance in the destructor. There, ->timeri can no longer change: the queue is unlinked and all use_lock borrowers have drained, so no snd_seq_queue_use() can re-open it. Close it before clearing q->timer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt() to finish, and that callback still reads q->timer (via snd_seq_check_queue()), so q->timer must stay valid until it drains.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.