What is the CVSS score of CVE-2026-68201?

CVE-2026-68201 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68201?

CVE-2026-68201 affects Linux kernel systems and allows standard users to elevate privileges to administrative level, creating risk for any organization running multi-tenant deployments or systems…. A patch is available.

How to fix or mitigate CVE-2026-68201?

Within 24 hours, identify all Linux systems running vulnerable kernel versions using your asset management and vulnerability scanning tools, with particular attention to production systems, development servers, and multi-user deployments. Within 7 days, contact your Linux distribution vendor or kernel maintainers to obtain the patched stable kernel release and perform compatibility testing in your non-production environment. Within 30 days, deploy patched kernel updates to all affected production systems during planned maintenance windows, prioritizing systems with the largest number of non-administrative user accounts.

Linux Kernel CVE-2026-68201

EUVD-2026-55302 HIGH

2026-08-10 Linux

GHSA-793q-4mv8-rvwh

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition requires winning a precise timing window (AC:H); local ALSA device access is available to low-privilege audio-group users without root (PR:L, AV:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 03:36 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 12:00 cve.org

HIGH 7.8

CVE Published

Aug 10, 2026 - 12:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: drain a slave's callback before its master detaches it

snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a master instance is closed, remove_slave_links() clears each slave's ->timer; the slave's own close then reads timer == NULL and takes the branch that skips the drain entirely (snd_timer_stop_slave() also no-ops on a NULL timer). So a slave whose callback is still running when the master is closed is freed underneath the live callback, leading to use-after-free.

Drain the slaves too before remove_slave_links() severs them. snd_timer_stop() has already taken this instance off the active list, so no new slave callback can be queued. Take the slaves off the ack list so a pending one can't fire either, then wait for any that is already in flight.

AnalysisAI

Use-after-free in the Linux kernel ALSA timer subsystem allows a local low-privileged attacker to corrupt kernel memory by exploiting a race condition during master-slave timer instance teardown. When a master timer closes, slave callback draining is skipped, causing the slave struct to be freed while its callback executes in parallel - a classic UAF primitive with potential for local privilege escalation. EPSS is low at 0.21% (11th percentile), no KEV listing exists, and no public exploit code has been identified at time of analysis, but patched stable kernel releases are available.

Technical ContextAI

The ALSA (Advanced Linux Sound Architecture) timer subsystem implements a master-slave relationship between timer instances. In snd_timer_close_locked(), the closing code drains the master instance's own in-flight IFLG_CALLBACK flag but omits draining any slave instances' callbacks before invoking remove_slave_links(). Once remove_slave_links() clears each slave's ->timer pointer to NULL, the slave's subsequent close path branches on timer == NULL and skips its own drain; snd_timer_stop_slave() likewise no-ops on a NULL timer. This creates a window where the slave struct is freed while its callback is still executing in a concurrent thread, producing a use-after-free - a condition that maps to CWE-416 despite the source listing CWE as N/A. The fix drains slave callbacks and removes slaves from the ack list before remove_slave_links() severs the relationship. Affected CPE: cpe:2.3:a:linux:linux:*.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 7.2-rc5 or later on the 7.2 mainline, 7.1.6 or later on the 7.1 stable branch, 6.12.101 or later on the 6.12 LTS branch, or 6.18.42 or later on the 6.18 branch. The four upstream fix commits are available at git.kernel.org/stable/c/ with hashes cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0, 426c0ff1c433d6030610ad4f9375746dfe931caa, 2b298997786876b225cff2446e11a0fa6f602f6d, and bdefe1346a8e6b8dc8593406dc2617e985fcbcab. Where kernel upgrades are not immediately feasible, restrict access to /dev/snd/timer via udev rules or by removing untrusted users from the audio group - this eliminates the attack surface at the cost of breaking ALSA-dependent audio applications for those users. On server systems where audio is unused, blacklisting the snd_timer module in /etc/modprobe.d/blacklist.conf and rebooting removes the subsystem entirely with no functional impact. NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-68201.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68201 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68201

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code