In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Don't take register_mutex with copy_from/to_user()
The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they might lead to deadlocks.
In the case of ALSA timer code, the bad pattern is with guard(mutex)(®ister_mutex) that covers copy_from/to_user() -- which was mistakenly introduced at converting to guard(), and it had been carefully worked around in the past.
This patch fixes those pieces simply by moving copy_from/to_user() out of the register mutex lock again.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2025 |
| Suse | — | Upgrade kernel-default-develUpgrade kernel-sourceUpgrade kernel-default-extraUpgrade kernel-64kbUpgrade kernel-64kb-develUpgrade kernel-develUpgrade kernel-obs-qaUpgrade kernel-azure-extraUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade kernel-syms-azureUpgrade kernel-kvmsmall-develUpgrade kernel-zfcpdumpUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-symsUpgrade kernel-source-azureUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade kernel-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-vdsoUpgrade kernel-docsUpgrade kernel-64kb-extraUpgrade kernel-azure-develUpgrade kernel-defaultUpgrade kernel-source-vanillaUpgrade kernel-default-livepatchUpgrade kernel-obs-build | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-azure-6.11Upgrade linux-image-oem-24.04bUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-gcpUpgrade linux-image-azureUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-azure-fde-edgeUpgrade linux-image-lowlatencyUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-raspiUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-azure-fdeUpgrade linux-image-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-aws-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-lowlatency-6.11Upgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-awsUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-oracleUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-azure-fde-6.11Upgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.11.0-1015-lowlatency-64k | Jun 26, 2025 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub