CVE-2026-74503

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ALSA timer component where the snd timer close locked() function marks an instance with the SNDRV TIMER IFLG DEAD flag but fails to clear it upon completion. This can lead to a use-after-free scenario if an instance is reopened via snd seq timer open() after a failure that internally triggered snd timer close locked(). An unprivileged user with access to /dev/snd/timer and /dev/snd/seq can force this failure by forging a sequencer queue's key using SNDRV TIMER IOCTL SELECT with dev class set to SNDRV TIMER CLASS SLAVE, causing snd timer check master() to return -EBUSY when max instances is reached. Consequently, snd timer instance free() may free an object that remains active on the timer->open list head or snd timer master list. Subsequent calls to snd timer open(), snd timer check slave(), or access to /proc/asound/timers can then dereference the freed instance, leading to a system fault via the stale ti->owner pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.