https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:15:31 +0000 https://cve.radiocsirt.org/vuln/cve-2021-47281 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: seq: Fix race of snd_seq_timer_open()</p> <p>The timer instance per queue is exclusive, and snd_seq_timer_open() should have managed the concurrent accesses. It looks as if it&#39;s checking the already existing timer instance at the beginning, but it&#39;s not right, because there is no protection, hence any later concurrent call of snd_seq_timer_open() may override the timer instance easily. This may result in UAF, as the leftover timer instance can keep running while the queue itself gets closed, as spotted by syzkaller recently.</p> <p>For avoiding the race, add a proper check at the assignment of tmr-&gt;timeri again, and return -EBUSY if it&#39;s been already registered.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: seq: Fix race of snd_seq_timer_open()</p> <p>The timer instance per queue is exclusive, and snd_seq_timer_open() should have managed the concurrent accesses. It looks as if it&#39;s checking the already existing timer instance at the beginning, but it&#39;s not right, because there is no protection, hence any later concurrent call of snd_seq_timer_open() may override the timer instance easily. This may result in UAF, as the leftover timer instance can keep running while the queue itself gets closed, as spotted by syzkaller recently.</p> <p>For avoiding the race, add a proper check at the assignment of tmr-&gt;timeri again, and return -EBUSY if it&#39;s been already registered.</p> https://cve.radiocsirt.org/vuln/cve-2021-47281