CVE-2026-74504

Received Received - Intake

Division by Zero in Linux Kernel ALSA Sequencer Timer

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initialize_timer() A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set the backing snd_timer's hardware resolution to an arbitrary 64-bit value via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero. When such a timer is bound to a sequencer queue, initialize_timer() computes the tick period as tmr->ticks = 1000000000 / (r * freq); where r is that user-controlled resolution and freq is the sequencer update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250). A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for any even freq, including DEFAULT_FREQUENCY (1000), so the division faults with a divide-by-zero. The division runs under tmr->lock with interrupts disabled, so the oops leaves the spinlock held and hangs the CPU. It is reachable by an unprivileged user with access to /dev/snd/timer and /dev/snd/seq. Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+ RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0 snd_seq_timer_start+0x15e/0x2b0 snd_seq_control_queue+0x56f/0xba0 snd_seq_write+0x3e0/0x730 Reject an overflowing product with check_mul_overflow() and fall back to a single tick, which also avoids feeding a wrapped-but-nonzero divisor (e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small value) into the period computation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74504

EUVD

EUVD-2026-59697

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.2.0-rc4+

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a divide-by-zero vulnerability in the Linux kernel's ALSA sequencer timer subsystem. An unprivileged user can set a timer's hardware resolution to an extremely large value (2^63), causing a division operation to fault when calculating the timer tick period. This leads to a kernel oops that hangs the CPU due to a held spinlock.

Detection Guidance

This vulnerability can be detected by checking for unprivileged users accessing /dev/snd/timer or /dev/snd/seq. Monitor for divide-by-zero errors in kernel logs or system hangs during ALSA timer operations. No specific commands are provided in the context.

Impact Analysis

An attacker with access to /dev/snd/timer and /dev/snd/seq could trigger this flaw, causing a system crash (kernel panic) and denial of service. The vulnerability requires local access but no special privileges.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local denial-of-service issue in the Linux kernel's ALSA sequencer timer component, causing system hangs but not data breaches or unauthorized access. Compliance impact would only occur if the system outage disrupts regulated operations.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Ensure the kernel version is updated to one that includes the fix for ALSA: seq: Fix division by zero in initialize_timer(). Restrict access to /dev/snd/timer and /dev/snd/seq to trusted users.

Hi! I’m here to help you understand CVE-2026-74504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70