CVE-2026-68202 ALSA UAF Fixed in Five Linux Kernel Lines

The vulnerability sits in

, the timer machinery behind ALSA’s MIDI/sequencer queue handling. Linux kernel developer Norbert Szetei’s patch, merged through Takashi Iwai’s ALSA sound tree and listed in the Linux 7.2-rc5 changes covered by LWN.net, corrects a teardown race that can leave a live timer callback pointing at a queue structure the kernel has already freed.

For affected systems, the practical action is straightforward: update to a vendor kernel carrying the fix. Do not rely on the absence of an NVD severity score as a reason to defer it.

A queue teardown race turns into a stale kernel pointer​

The vulnerable sequence begins when ALSA deletes a sequencer queue. The existing teardown path closes the queue’s timer, waits for borrowers of the queue to drain, and then frees the timer and queue objects. That ordering appears reasonable until another task has already acquired a temporary queue reference before the queue is unlinked.

According to the kernel.org description reproduced by NVD, that borrower can execute

after the original close operation has cleared the timer’s active-instance pointer. Because the open path only rejects a new open while that pointer is populated, it can create a new timer instance in the gap between the first close and the final free.

The destructor then frees the timer object without closing that newly re-opened instance. The queue is freed next, yet the lingering timer remains connected to ALSA’s global timer system with callback data still aimed at the former queue. A subsequent queue-start operation causes the next timer tick to enter

and dereference freed memory.

This is a classic use-after-free: an object is destroyed while a still-reachable callback retains its address. It is a memory-safety defect inside kernel space, not an audio playback bug and not a flaw confined to a misbehaving desktop application.

The upstream fix does not attempt to make the original early close more restrictive. Instead, it closes any remaining timer instance in the queue destructor, after the queue is unlinked and outstanding

borrowers have drained. At that point, the code can guarantee that no path can re-open the timer. The patch also preserves the queue timer pointer until

has waited for any in-progress interrupt callback to complete, because that callback can still consult the queue timer while unwinding.

That last detail is important: this is not a one-line nulling fix. The correction changes the object-lifetime boundary so the timer callback cannot outlive the data it uses.

The access requirement is limited, but ownership checks do not save affected systems​

NVD’s record is unusually explicit about reachability. It says the flaw can be triggered by an unprivileged user with access to

; no Linux capability and no ownership of the target queue are required. In other words, kernel access control around queue ownership does not prevent the final arming operation in the described race.

That does not make CVE-2026-68202 a remote, pre-authentication Windows-facing vulnerability. An attacker first needs code execution on the Linux machine, virtual machine, container, or WSL environment, plus access to the ALSA sequencer device. The exposed surface is therefore most relevant to multi-user Linux workstations, shared development servers, audio/MIDI production systems, kiosk-like deployments, and containers that have been given host sound-device access.

The device-node prerequisite also means exposure is configuration-dependent. Systems without ALSA sequencer support, systems where

is absent, and workloads where untrusted users cannot access that node do not meet the published trigger condition. But “we do not use MIDI” is not a sufficient assessment by itself. The vulnerable component is the kernel’s sequencer subsystem; it may be enabled for application compatibility or loaded even where an administrator does not regard the host as an audio workstation.

Administrators can establish whether the immediate prerequisite exists with a simple check:

If the node is present, identify the running kernel with:

Then check the distribution’s kernel changelog or security tracker for a backport of CVE-2026-68202. That second step matters because enterprise distributions routinely ship a kernel version whose visible number predates an upstream release while still containing the security patch.

There is no sound basis, at this stage, to claim a working privilege-escalation exploit. The published record documents a reachable kernel use-after-free and the kernel fix; it does not provide exploit code, a demonstrated root compromise, or a CVSS assessment. The correct operational conclusion is still to patch promptly: uncontrolled kernel memory lifetime is the condition defenders are trying to remove, whether the observed result is a crash, memory corruption, or a more serious outcome on a particular build.

Five stable branches have fixes, and the version boundaries are specific​

The CVE record from kernel.org identifies Linux as affected from version 2.6.12 onward, then names fixed release points in five maintained lines. Those upstream boundaries are:

• Linux 6.6.148.
• Linux 6.12.101.
• Linux 6.18.42.
• Linux 7.1.6.
• Linux 7.2-rc5.

The patch was authored by Norbert Szetei and is present in Takashi Iwai’s ALSA sound tree as

. NVD also lists distinct stable-tree commits for the supported maintenance branches. The mainline-side appearance in Linux 7.2-rc5 is independently visible in LWN.net’s release coverage, which lists the ALSA sequencer fix among the changes landing in that release candidate.

There is a timing issue worth calling out. The NVD record was published on August 10, 2026, while the patch was only recently merged upstream. That leaves downstream maintainers at different points in their backport and advisory cycles. As of August 11, neither NVD nor the public kernel record supplies a CVSS score, and no vendor severity rating should be inferred from the fix’s inclusion in a stable release.

The NVD version data is also not a package inventory. It tells administrators where upstream stable fixes landed; it does not tell them whether Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, SUSE, Android-derived kernels, appliance firmware, or cloud images have shipped those changes under their own package versions. A kernel reporting

,

, or

is not enough information on its own.

WSL2 deserves verification, not assumptions​

Windows users are not directly affected through the Windows kernel. CVE-2026-68202 is a Linux kernel flaw in ALSA sequencer code. But WSL2 runs a real Microsoft-maintained Linux kernel in a lightweight virtual machine, which makes it a legitimate item for Windows administrators who allow local development workloads, audio tooling, or custom kernel configurations.

Microsoft’s public WSL2-Linux-Kernel repository currently tracks a

branch and publishes the configuration and source used to build the WSL2 kernel. That establishes the relevant maintenance line, but it does not establish that a given installed WSL kernel includes this particular backport. Microsoft has not, in the material currently associated with CVE-2026-68202, published a Windows security bulletin, a WSL update number, or a statement that the ALSA sequencer configuration is enabled in every WSL installation.

That gap has a concrete implication: a WSL2 host should not be marked exposed merely because its underlying source branch is related to Linux 6.18, nor marked fixed merely because

shows a current WSL application package. The relevant evidence is the kernel release actually running in the WSL VM, the presence of

, and Microsoft’s eventual inclusion of the upstream fix or an equivalent backport.

For managed fleets, inventory custom WSL kernels separately. Microsoft documents support for custom WSL2 kernels through

; those are outside the normal Microsoft-serviced kernel path and should be checked against the upstream patch directly. The same rule applies to Docker hosts, developer VMs, audio-production appliances, and Linux virtual machines where the host kernel is updated on a different cadence from user-space packages.

CVE-2026-68202 is not yet a scored emergency, and no public exploitation has been documented. It is, however, a confirmed unprivileged path to a dangling pointer in the kernel’s ALSA sequencer timer code. The fix is already identified across Linux 6.6, 6.12, 6.18, 7.1, and 7.2-rc5; the remaining work is for distribution and WSL maintainers to expose that repair in the kernels their users actually boot.