High [CVE-2026-53192] Fix UAF at snd_timer_user_params

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources.

However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races.

But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround.

It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) timer component.

A race condition can occur during the release of a timer object, specifically when the SNDRV_TIMER_IOCTL_PARAMS ioctl is called concurrently. This can lead to a use-after-free vulnerability, potentially allowing a local attacker to achieve arbitrary code execution or cause a denial of service.