CVE-2026-74504

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74504", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.908Z", "datePublished": "2026-08-15T12:27:28.829Z", "dateUpdated": "2026-08-17T05:20:43.047Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:20:43.047Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix division by zero in initialize_timer()\n\nA userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set\nthe backing snd_timer's hardware resolution to an arbitrary 64-bit value\nvia SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.\n\nWhen such a timer is bound to a sequencer queue, initialize_timer()\ncomputes the tick period as\n\n\ttmr->ticks = 1000000000 / (r * freq);\n\nwhere r is that user-controlled resolution and freq is the sequencer\nupdate rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).\nA resolution of 2^63 makes the 64-bit product r * freq wrap to zero for\nany even freq, including DEFAULT_FREQUENCY (1000), so the division faults\nwith a divide-by-zero.\n\nThe division runs under tmr->lock with interrupts disabled, so the oops\nleaves the spinlock held and hangs the CPU. It is reachable by an\nunprivileged user with access to /dev/snd/timer and /dev/snd/seq.\n\n Oops: divide error: 0000 [#1] SMP KASAN PTI\n CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+\n RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0\n snd_seq_timer_start+0x15e/0x2b0\n snd_seq_control_queue+0x56f/0xba0\n snd_seq_write+0x3e0/0x730\n\nReject an overflowing product with check_mul_overflow() and fall back to\na single tick, which also avoids feeding a wrapped-but-nonzero divisor\n(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small\nvalue) into the period computation."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/seq/seq_timer.c"], "versions": [{"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "d0e19932875746118e298b4c974f3b2d4aeb16fc", "status": "affected", "versionType": "git"}, {"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "5260e195c53e898a4a76527d4bb2178f31795e78", "status": "affected", "versionType": "git"}, {"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "42c6543ff27ea280334244458d4f52ec7133cc05", "status": "affected", "versionType": "git"}, {"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "21e19688433452dfbbbe6b2bb670dea6eb92f0f6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/seq/seq_timer.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d0e19932875746118e298b4c974f3b2d4aeb16fc"}, {"url": "https://git.kernel.org/stable/c/5260e195c53e898a4a76527d4bb2178f31795e78"}, {"url": "https://git.kernel.org/stable/c/42c6543ff27ea280334244458d4f52ec7133cc05"}, {"url": "https://git.kernel.org/stable/c/21e19688433452dfbbbe6b2bb670dea6eb92f0f6"}], "title": "ALSA: seq: Fix division by zero in initialize_timer()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/core/seq/seq_timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d0e19932875746118e298b4c974f3b2d4aeb16fc", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}, {"lessThan": "5260e195c53e898a4a76527d4bb2178f31795e78", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}, {"lessThan": "42c6543ff27ea280334244458d4f52ec7133cc05", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}, {"lessThan": "21e19688433452dfbbbe6b2bb670dea6eb92f0f6", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/core/seq/seq_timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix division by zero in initialize_timer()\n\nA userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set\nthe backing snd_timer's hardware resolution to an arbitrary 64-bit value\nvia SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.\n\nWhen such a timer is bound to a sequencer queue, initialize_timer()\ncomputes the tick period as\n\n\ttmr->ticks = 1000000000 / (r * freq);\n\nwhere r is that user-controlled resolution and freq is the sequencer\nupdate rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).\nA resolution of 2^63 makes the 64-bit product r * freq wrap to zero for\nany even freq, including DEFAULT_FREQUENCY (1000), so the division faults\nwith a divide-by-zero.\n\nThe division runs under tmr->lock with interrupts disabled, so the oops\nleaves the spinlock held and hangs the CPU. It is reachable by an\nunprivileged user with access to /dev/snd/timer and /dev/snd/seq.\n\n Oops: divide error: 0000 [#1] SMP KASAN PTI\n CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+\n RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0\n snd_seq_timer_start+0x15e/0x2b0\n snd_seq_control_queue+0x56f/0xba0\n snd_seq_write+0x3e0/0x730\n\nReject an overflowing product with check_mul_overflow() and fall back to\na single tick, which also avoids feeding a wrapped-but-nonzero divisor\n(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small\nvalue) into the period computation."}], "id": "CVE-2026-74504", "lastModified": "2026-08-17T06:19:46.953", "metrics": {}, "published": "2026-08-15T13:17:55.427", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/21e19688433452dfbbbe6b2bb670dea6eb92f0f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/42c6543ff27ea280334244458d4f52ec7133cc05"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5260e195c53e898a4a76527d4bb2178f31795e78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0e19932875746118e298b4c974f3b2d4aeb16fc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: seq: Fix division by zero in initialize_timer()", "id": "2516968", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516968"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: seq: Fix division by zero in initialize_timer()\nA userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set\nthe backing snd_timer's hardware resolution to an arbitrary 64-bit value\nvia SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.\nWhen such a timer is bound to a sequencer queue, initialize_timer()\ncomputes the tick period as\ntmr->ticks = 1000000000 / (r * freq);\nwhere r is that user-controlled resolution and freq is the sequencer\nupdate rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).\nA resolution of 2^63 makes the 64-bit product r * freq wrap to zero for\nany even freq, including DEFAULT_FREQUENCY (1000), so the division faults\nwith a divide-by-zero.\nThe division runs under tmr->lock with interrupts disabled, so the oops\nleaves the spinlock held and hangs the CPU. It is reachable by an\nunprivileged user with access to /dev/snd/timer and /dev/snd/seq.\nOops: divide error: 0000 [#1] SMP KASAN PTI\nCPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+\nRIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0\nsnd_seq_timer_start+0x15e/0x2b0\nsnd_seq_control_queue+0x56f/0xba0\nsnd_seq_write+0x3e0/0x730\nReject an overflowing product with check_mul_overflow() and fall back to\na single tick, which also avoids feeding a wrapped-but-nonzero divisor\n(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small\nvalue) into the period computation.", "A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) sequencer component. An unprivileged local user with access to ALSA timer and sequencer devices can trigger a division-by-zero error. This occurs by manipulating the ALSA timer's hardware resolution, leading to an integer overflow during a calculation, which results in a system hang and a Denial of Service."], "name": "CVE-2026-74504", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74504\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74504\nhttps://lore.kernel.org/linux-cve-announce/2026081541-CVE-2026-74504-ea1f@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37745918e0e7575bc40f38da93a99b9fa6406224,d0e19932875746118e298b4c974f3b2d4aeb16fc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37745918e0e7575bc40f38da93a99b9fa6406224,5260e195c53e898a4a76527d4bb2178f31795e78)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37745918e0e7575bc40f38da93a99b9fa6406224,42c6543ff27ea280334244458d4f52ec7133cc05)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37745918e0e7575bc40f38da93a99b9fa6406224,21e19688433452dfbbbe6b2bb670dea6eb92f0f6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T15:00:04.341077+00:00", "updated": "2026-08-21T20:30:07.398794+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-190", "CWE-369"]}