CVE-2021-47281

What it actually does

Race condition in snd_seq_timer_open allows concurrent calls to override the exclusive timer instance without protection, resulting in a leftover timer continuing to run after queue closure and causing use-after-free.

Why it matters to the business

Systems running vulnerable kernels may experience kernel instability, crashes, or potential privilege escalation, increasing downtime and patch urgency for exposed Linux audio/sequencer workloads.

How an attack unfolds

An attacker with local access triggers multiple concurrent snd_seq_timer_open calls on the same queue; the lack of atomic check lets a second call replace the timer instance, leaving the original running after the queue is closed and enabling UAF.

How to fix it

Update the Linux kernel to a version containing the fix for snd_seq_timer_open that adds the duplicate-registration check returning -EBUSY; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains the upstream commit adding the atomic check before tmr->timeri assignment; inspect dmesg or kernel logs for absence of the race and confirm no duplicate timer registrations succeed.

Typical attack path

1. Obtain local access to a system running a vulnerable kernel
2. Open an ALSA sequencer queue via /dev/snd/seq
3. Issue concurrent snd_seq_timer_open calls from multiple threads or processes
4. Close the queue while the original timer instance remains active
5. Trigger use-after-free via continued timer operations to crash or escalate

How to detect it

Review kernel logs for ALSA seq timer-related oops or warnings, audit calls to snd_seq_timer_open in strace or ftrace, and search for evidence of concurrent sequencer queue operations preceding crashes.

What your security team should do

• Apply the kernel patch or distribution update containing the fix as highest priority
• Restrict untrusted local access to sequencer devices until patched
• Monitor for kernel oops or UAF reports related to ALSA seq in production workloads
• Test patched kernels in staging environments before broad deployment