In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Fix UAF at snd_timer_user_params()

At releasing a timer object, e.g. when a userspace timer
(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it
tries to detach the timer instances and release the resources.
However, it's still possible that other in-flight tasks are holding
the timer instance where the to-be-deleted timer object is associated,
and this may lead to racy accesses.

Fortunately, most of ioctls dealing with the timer instance list
already have the protection with register_mutex, and this also avoids
such races.  But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the
concurrent ioctl may lead to use-after-free.

This patch just adds the guard with register_mutex to protect
snd_timer_user_params() for covering the code path as a quick
workaround.  It's no hot-path but rather a rarely issued ioctl, so the
performance penalty doesn't matter.

https://git.kernel.org/stable/c/053a401b592be424fea9d57c789f66cd5d8cec11

https://git.kernel.org/stable/c/117743d62e1225e208568a3ffc2c07214f1347cb

https://git.kernel.org/stable/c/306427adf9b97e29e5958cb9cf3096c6151fc9ff

https://git.kernel.org/stable/c/38034d04d4a75bbca01df2b313ced0bcd0fa3242

https://git.kernel.org/stable/c/3d39da65b5c422c5e5afb7d5651b0698d060a827

https://git.kernel.org/stable/c/92ad2d7f80cad43b046f093e808e11fe919d304a

https://git.kernel.org/stable/c/b2214914e461d0466548a52dfe4f4ee8ce362276

https://git.kernel.org/stable/c/e2331730175f74169046d2af8db1b47243df7c7a

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/core/timer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"92ad2d7f80cad43b046f093e808e11fe919d304a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"117743d62e1225e208568a3ffc2c07214f1347cb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b2214914e461d0466548a52dfe4f4ee8ce362276","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e2331730175f74169046d2af8db1b47243df7c7a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"38034d04d4a75bbca01df2b313ced0bcd0fa3242","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3d39da65b5c422c5e5afb7d5651b0698d060a827","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"306427adf9b97e29e5958cb9cf3096c6151fc9ff","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"053a401b592be424fea9d57c789f66cd5d8cec11","versionType":"git","status":"affected"},{"version":"0","lessThan":"5.10.259","versionType":"semver","status":"affected"},{"version":"0","lessThan":"5.15.210","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.1.176","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.6.143","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.12.94","versionType":"semver","status":"affected"},{"version":"0","lessThan":"6.18.36","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.0.13","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/core/timer.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.94","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.36","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.13","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]