In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Don't take register_mutex with copy_from/to_user()
The infamous mmap_lock taken in copy_from/to_user() can be often problematic when it's called inside another mutex, as they might lead to deadlocks.
In the case of ALSA timer code, the bad pattern is with guard(mutex)(®ister_mutex) that covers copy_from/to_user() -- which was mistakenly introduced at converting to guard(), and it had been carefully worked around in the past.
This patch fixes those pieces simply by moving copy_from/to_user() out of the register mutex lock again.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2025 |
| Suse | — | Upgrade kernel-docsUpgrade kernel-azure-vdsoUpgrade kernel-64kb-extraUpgrade kernel-azureUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade kernel-defaultUpgrade kernel-azure-develUpgrade kernel-default-livepatchUpgrade kernel-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-kvmsmall-develUpgrade kernel-develUpgrade kernel-64kb-develUpgrade kernel-sourceUpgrade kernel-obs-qaUpgrade kernel-azure-extraUpgrade kernel-symsUpgrade kernel-devel-azureUpgrade kernel-macrosUpgrade kernel-kvmsmallUpgrade kernel-default-vdsoUpgrade kernel-default-extraUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade kernel-zfcpdump | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade linux-image-raspiUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-oem-24.04bUpgrade linux-image-6.11.0-28-genericUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-azure-6.11Upgrade linux-image-gcpUpgrade linux-image-6.11.0-1018-azureUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-azureUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-generic-64kUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fde-edgeUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-virtualUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-realtimeUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-lowlatency-6.11Upgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-azure-fde-6.11Upgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-gcp-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-awsUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-azure | Jun 26, 2025 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub