{"id":"CVE-2026-74504","state":"PUBLISHED","title":"ALSA: seq: Fix division by zero in initialize_timer()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix division by zero in initialize_timer()\n\nA userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set\nthe backing snd_timer's hardware resolution to an arbitrary 64-bit value\nvia SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.\n\nWhen such a timer is bound to a sequencer queue, initialize_timer()\ncomputes the tick period as\n\n\ttmr->ticks = 1000000000 / (r * freq);\n\nwhere r is that user-controlled resolution and freq is the sequencer\nupdate rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).\nA resolution of 2^63 makes the 64-bit product r * freq wrap to zero for\nany even freq, including DEFAULT_FREQUENCY (1000), so the division faults\nwith a divide-by-zero.\n\nThe division runs under tmr->lock with interrupts disabled, so the oops\nleaves the spinlock held and hangs the CPU. It is reachable by an\nunprivileged user with access to /dev/snd/timer and /dev/snd/seq.\n\n  Oops: divide error: 0000 [#1] SMP KASAN PTI\n  CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+\n  RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0\n   snd_seq_timer_start+0x15e/0x2b0\n   snd_seq_control_queue+0x56f/0xba0\n   snd_seq_write+0x3e0/0x730\n\nReject an overflowing product with check_mul_overflow() and fall back to\na single tick, which also avoids feeding a wrapped-but-nonzero divisor\n(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small\nvalue) into the period computation.","publishedAt":"2026-08-15T12:27:28.829Z","updatedAt":"2026-08-17T05:20:43.047Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","status":"affected","lessThan":"d0e19932875746118e298b4c974f3b2d4aeb16fc","versionType":"git"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","status":"affected","lessThan":"5260e195c53e898a4a76527d4bb2178f31795e78","versionType":"git"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","status":"affected","lessThan":"42c6543ff27ea280334244458d4f52ec7133cc05","versionType":"git"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","status":"affected","lessThan":"21e19688433452dfbbbe6b2bb670dea6eb92f0f6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/core/seq/seq_timer.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.12","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/core/seq/seq_timer.c"]}],"references":["https://git.kernel.org/stable/c/d0e19932875746118e298b4c974f3b2d4aeb16fc","https://git.kernel.org/stable/c/5260e195c53e898a4a76527d4bb2178f31795e78","https://git.kernel.org/stable/c/42c6543ff27ea280334244458d4f52ec7133cc05","https://git.kernel.org/stable/c/21e19688433452dfbbbe6b2bb670dea6eb92f0f6"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74504.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74504","state":"PUBLISHED","datePublished":"2026-08-15T12:27:28.829Z","dateUpdated":"2026-08-17T05:20:43.047Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.908Z"},"containers":{"cna":{"title":"ALSA: seq: Fix division by zero in initialize_timer()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix division by zero in initialize_timer()\n\nA userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set\nthe backing snd_timer's hardware resolution to an arbitrary 64-bit value\nvia SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.\n\nWhen such a timer is bound to a sequencer queue, initialize_timer()\ncomputes the tick period as\n\n\ttmr->ticks = 1000000000 / (r * freq);\n\nwhere r is that user-controlled resolution and freq is the sequencer\nupdate rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).\nA resolution of 2^63 makes the 64-bit product r * freq wrap to zero for\nany even freq, including DEFAULT_FREQUENCY (1000), so the division faults\nwith a divide-by-zero.\n\nThe division runs under tmr->lock with interrupts disabled, so the oops\nleaves the spinlock held and hangs the CPU. It is reachable by an\nunprivileged user with access to /dev/snd/timer and /dev/snd/seq.\n\n  Oops: divide error: 0000 [#1] SMP KASAN PTI\n  CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+\n  RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0\n   snd_seq_timer_start+0x15e/0x2b0\n   snd_seq_control_queue+0x56f/0xba0\n   snd_seq_write+0x3e0/0x730\n\nReject an overflowing product with check_mul_overflow() and fall back to\na single tick, which also avoids feeding a wrapped-but-nonzero divisor\n(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small\nvalue) into the period computation."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","status":"affected","lessThan":"d0e19932875746118e298b4c974f3b2d4aeb16fc","versionType":"git"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","status":"affected","lessThan":"5260e195c53e898a4a76527d4bb2178f31795e78","versionType":"git"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","status":"affected","lessThan":"42c6543ff27ea280334244458d4f52ec7133cc05","versionType":"git"},{"version":"37745918e0e7575bc40f38da93a99b9fa6406224","status":"affected","lessThan":"21e19688433452dfbbbe6b2bb670dea6eb92f0f6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/core/seq/seq_timer.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.12","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/core/seq/seq_timer.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d0e19932875746118e298b4c974f3b2d4aeb16fc"},{"url":"https://git.kernel.org/stable/c/5260e195c53e898a4a76527d4bb2178f31795e78"},{"url":"https://git.kernel.org/stable/c/42c6543ff27ea280334244458d4f52ec7133cc05"},{"url":"https://git.kernel.org/stable/c/21e19688433452dfbbbe6b2bb670dea6eb92f0f6"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T05:20:43.047Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}