{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74503","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.908Z","datePublished":"2026-08-15T12:27:28.208Z","dateUpdated":"2026-08-17T05:47:54.696Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:47:54.696Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes\n\nsnd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD\nand returns early when the flag is already set, but the flag is never\ncleared again.  A completed close ends in remove_slave_links(), which\nleaves timeri->timer NULL, so a second close is already harmless through\nthe timer == NULL path; the early return can only be reached by an\ninstance that was opened again in between.  For such an instance the\nclose unlinks nothing, so snd_timer_instance_free() frees an object that\nis still on timer->open_list_head, still on snd_timer_master_list if it\nwas opened with a slave key, still owns any adopted slaves, and still\nholds its timer and module references.\n\nsnd_seq_timer_open() reopens an instance exactly like that: it retries\nits fallback open on the same object after a failure that has already\nrun snd_timer_close_locked() internally.  An unprivileged user with\naccess to /dev/snd/timer and /dev/snd/seq can force that failure, since\nsnd_timer_check_master() returns -EBUSY when a pending slave matches the\nnew master's (slave_class, slave_id) key and the target timer has\nreached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class =\nSNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a\nsequencer queue's key can be forged.  The freed instance is afterwards\ndereferenced by any further snd_timer_open() on that timer, by\nsnd_timer_check_slave(), and by /proc/asound/timers, which faults on the\nstale ti->owner pointer.\n\nThe flag only has to be visible while the close is in progress, which is\nall its other users need.  Clear it in remove_slave_links(), under the\nsame timer->lock that sets it, once the instance is off every list."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local ioctl access to /dev/snd/timer and /dev/snd/seq to forge timer slave keys and drive snd_seq_timer_open() retry logic; there is no network, adjacent-wireless, or physical-device entry path.\nAC:L - The attacker fully controls the ioctl and sequencer queue sequence that forces the initial -EBUSY close, retries snd_timer_open() on the same instance, and later triggers free; no uncontrollable timing, memory layout, or rare kernel state is required beyond standard ALSA being enabled.\nPR:L - The fix commit and reachable ioctl paths require only an unprivileged local user with access to ALSA device nodes (/dev/snd/timer and /dev/snd/seq), typical on desktops, kiosks, and Android systems via the audio group or equivalent permissions, not real root in the init namespace.\nUI:N - Exploitation is self-contained through attacker-initiated timer SELECT ioctls and sequencer queue open/close operations; no victim interaction such as opening files, mounting filesystems, or clicking prompts is required.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel address space; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - A use-after-free of snd_timer_instance leaves dangling list pointers; freed memory can be reallocated and later dereferenced by snd_timer_open(), snd_timer_check_slave(), or /proc/asound/timers, enabling arbitrary kernel memory read primitives.\nI:H - The UAF frees a structure still linked on timer open/master lists while retaining timer and module references, allowing heap reuse and memory corruption that can be leveraged for arbitrary kernel writes or control-flow hijacking.\nA:H - Stale timer instance pointers are dereferenced during subsequent timer operations and /proc/asound/timers reads, causing kernel faults/oops; UAF reliably threatens crashes even before full exploitation."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/core/timer.c"],"versions":[{"version":"586b219a22b1032b28b8bd356b963276c5e5bf53","lessThan":"bb016091010ec401a06e6bdace0cd944ee03d371","status":"affected","versionType":"git"},{"version":"f46093dd22969037beb1fce2e043f3236be41c92","lessThan":"a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e","status":"affected","versionType":"git"},{"version":"da3039e91d1f835874ed6e9a33ea19ee80c2cb92","lessThan":"0c561fab50991df10b1e4daca25886c34a2a9c07","status":"affected","versionType":"git"},{"version":"da3039e91d1f835874ed6e9a33ea19ee80c2cb92","lessThan":"c2744d5f3aea474513fd2298daecb94a952ce441","status":"affected","versionType":"git"},{"version":"60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f","status":"affected","versionType":"git"},{"version":"6.12.94","lessThan":"6.12.103","status":"affected","versionType":"semver"},{"version":"6.18.36","lessThan":"6.18.44","status":"affected","versionType":"semver"},{"version":"7.0.13","lessThan":"7.1","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/core/timer.c"],"versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","status":"unaffected","versionType":"semver"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.94","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18.36","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.1","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.13"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/bb016091010ec401a06e6bdace0cd944ee03d371"},{"url":"https://git.kernel.org/stable/c/a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e"},{"url":"https://git.kernel.org/stable/c/0c561fab50991df10b1e4daca25886c34a2a9c07"},{"url":"https://git.kernel.org/stable/c/c2744d5f3aea474513fd2298daecb94a952ce441"}],"title":"ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes","x_generator":{"engine":"bippy-1.2.0"}}}}