CVE-2026-74504 - Vulnerability Details

- ALSA: seq: Fix division by zero in initialize_timer()

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Fix division by zero in initialize_timer()

A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set
the backing snd_timer's hardware resolution to an arbitrary 64-bit value
via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.

When such a timer is bound to a sequencer queue, initialize_timer()
computes the tick period as

tmr->ticks = 1000000000 / (r * freq);

where r is that user-controlled resolution and freq is the sequencer
update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).
A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for
any even freq, including DEFAULT_FREQUENCY (1000), so the division faults
with a divide-by-zero.

The division runs under tmr->lock with interrupts disabled, so the oops
leaves the spinlock held and hangs the CPU. It is reachable by an
unprivileged user with access to /dev/snd/timer and /dev/snd/seq.

Oops: divide error: 0000 [#1] SMP KASAN PTI
CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+
RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0
snd_seq_timer_start+0x15e/0x2b0
snd_seq_control_queue+0x56f/0xba0
snd_seq_write+0x3e0/0x730

Reject an overflowing product with check_mul_overflow() and fall back to
a single tick, which also avoids feeding a wrapped-but-nonzero divisor
(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small
value) into the period computation.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An unprivileged user can create an ALSA user‑driven timer with an arbitrary 64‑bit resolution value via SNDRV_TIMER_IOCTL_CREATE. When such a timer is bound to a sequencer queue, the kernel computes the tick period with the expression 1000000000/(r*freq). If the resolution r is set to 2^63, r multiplied by any even frequency wraps to zero, causing a divide‑by‑zero fault inside initialize_timer(). The fault occurs while holding a spinlock with interrupts disabled, leaving the lock held and the CPU hung. This results in a kernel panic (OOPS) and effectively a denial of service on the affected system.

Affected Systems

All Linux kernel installations that include ALSA and expose the /dev/snd/timer and /dev/snd/seq device nodes are affected. No specific kernel release numbers are listed as impacted, implying that any version before the patch could be vulnerable until the kernel is updated to the latest stable kernel.

Risk and Exploitability

The vulnerability is exploitable by any local user who has permission to open /dev/snd/timer and /dev/snd/seq. The CVSS score of 5.5 indicates medium severity and the EPSS score is below 1%, suggesting a low likelihood of exploitation. The exploit path results in a divide‑by‑zero during tick period calculation, causing the kernel to panic and a system hang. This local privilege escalation to denial of service can affect the entire system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`37745918e0e7575bc40f38da93a99b9fa6406224`	affected	< d0e19932875746118e298b4c974f3b2d4aeb16fc
`37745918e0e7575bc40f38da93a99b9fa6406224`	affected	< 5260e195c53e898a4a76527d4bb2178f31795e78
`37745918e0e7575bc40f38da93a99b9fa6406224`	affected	< 42c6543ff27ea280334244458d4f52ec7133cc05
`37745918e0e7575bc40f38da93a99b9fa6406224`	affected	< 21e19688433452dfbbbe6b2bb670dea6eb92f0f6

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[37745918e0e7575bc40f38da93a99b9fa6406224,d0e19932875746118e298b4c974f3b2d4aeb16fc)`	affected	code_commit	—
`[37745918e0e7575bc40f38da93a99b9fa6406224,5260e195c53e898a4a76527d4bb2178f31795e78)`	affected	code_commit	—
`[37745918e0e7575bc40f38da93a99b9fa6406224,42c6543ff27ea280334244458d4f52ec7133cc05)`	affected	code_commit	—
`[37745918e0e7575bc40f38da93a99b9fa6406224,21e19688433452dfbbbe6b2bb670dea6eb92f0f6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.12`	affected	generic	—
`[0,6.12)`	unaffected	generic	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2-rc6,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ALSA timer fix (commit 21e19688433452dfbbbe6b2bb670dea6eb92f0f6 and related patches).
If an immediate kernel upgrade is not possible, limit access to the ALSA timer and sequencer device nodes by setting the file permissions of /dev/snd/timer and /dev/snd/seq to root only, or by applying udev rules that restrict their use to privileged users.
Apply a local temporary patch to the kernel source that adds an overflow check to initialize_timer(), thereby preventing the divide‑by‑zero if an official update be applied immediately.

Generated by OpenCVE AI on August 21, 2026 at 20:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/21e19688433452dfbbbe6b2bb670dea6eb92f0f6
https://git.kernel.org/stable/c/42c6543ff27ea280334244458d4f52ec7133cc05
https://git.kernel.org/stable/c/5260e195c53e898a4a76527d4bb2178f31795e78
https://git.kernel.org/stable/c/d0e19932875746118e298b4c974f3b2d4aeb16fc
https://lore.kernel.org/linux-cve-announce/2026081541-CVE-2026-74504-ea1f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74504
https://www.cve.org/CVERecord?id=CVE-2026-74504

History

Fri, 21 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190
References		https://lore.kernel.org/linux-cve-announce/2026081541-CVE-2026-74504-ea1f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74504 https://www.cve.org/CVERecord?id=CVE-2026-74504
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-369

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize_timer() A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set the backing snd_timer's hardware resolution to an arbitrary 64-bit value via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero. When such a timer is bound to a sequencer queue, initialize_timer() computes the tick period as tmr->ticks = 1000000000 / (r * freq); where r is that user-controlled resolution and freq is the sequencer update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250). A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for any even freq, including DEFAULT_FREQUENCY (1000), so the division faults with a divide-by-zero. The division runs under tmr->lock with interrupts disabled, so the oops leaves the spinlock held and hangs the CPU. It is reachable by an unprivileged user with access to /dev/snd/timer and /dev/snd/seq. Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+ RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0 snd_seq_timer_start+0x15e/0x2b0 snd_seq_control_queue+0x56f/0xba0 snd_seq_write+0x3e0/0x730 Reject an overflowing product with check_mul_overflow() and fall back to a single tick, which also avoids feeding a wrapped-but-nonzero divisor (e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small value) into the period computation.
Title		ALSA: seq: Fix division by zero in initialize_timer()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/21e19688433452dfbbbe6b2bb670dea6eb92f0f6 https://git.kernel.org/stable/c/42c6543ff27ea280334244458d4f52ec7133cc05 https://git.kernel.org/stable/c/5260e195c53e898a4a76527d4bb2178f31795e78 https://git.kernel.org/stable/c/d0e19932875746118e298b4c974f3b2d4aeb16fc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:27:28.829Z

Updated: 2026-08-17T05:20:43.047Z

Reserved: 2026-08-15T05:44:03.908Z

Link: CVE-2026-74504

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:17:55.427

Modified: 2026-08-17T06:19:46.953

Link: CVE-2026-74504

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74504 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-21T20:30:07Z

Weaknesses

CWE-190
Integer Overflow or Wraparound
CWE-369
Divide By Zero

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object