CVE-2026-74504

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Fix division by zero in initialize_timer()

A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set

the backing snd_timer's hardware resolution to an arbitrary 64-bit value

via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.

When such a timer is bound to a sequencer queue, initialize_timer()

computes the tick period as

tmr->ticks = 1000000000 / (r * freq);

where r is that user-controlled resolution and freq is the sequencer

update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).

A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for

any even freq, including DEFAULT_FREQUENCY (1000), so the division faults

with a divide-by-zero.

The division runs under tmr->lock with interrupts disabled, so the oops

leaves the spinlock held and hangs the CPU. It is reachable by an

unprivileged user with access to /dev/snd/timer and /dev/snd/seq.

Oops:

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References