ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74503
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 13:17:55 UTC
Updated2026-08-15 13:17:55 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close ends in remove_slave_links(), which leaves timeri->timer NULL, so a second close is already harmless through the timer == NULL path; the early return can only be reached by an instance that was opened again in between. For such an instance the close unlinks nothing, so snd_timer_instance_free() frees an object that is still on timer->open_list_head, still on snd_timer_master_list if it was opened with a slave key, still owns any adopted slaves, and still holds its timer and module references. snd_seq_timer_open() reopens an instance exactly like that: it retries its fallback open on the same object after a failure that has already run snd_timer_close_locked() internally. An unprivileged user with access to /dev/snd/timer and /dev/snd/seq can force that failure, since snd_timer_check_master() returns -EBUSY when a pending slave matches the new master's (slave_class, slave_id) key and the target timer has reached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class = SNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a sequencer queue's key can be forged. The freed instance is afterwards dereferenced by any further snd_timer_open() on that timer, by snd_timer_check_slave(), and by /proc/asound/timers, which faults on the stale ti->owner pointer. The flag only has to be visible while the close is in progress, which is all its other users need. Clear it in remove_slave_links(), under the same timer->lock that sets it, once the instance is off every list.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 586b219a22b1032b28b8bd356b963276c5e5bf53 bb016091010ec401a06e6bdace0cd944ee03d371 git Not specified
CNA Linux Linux affected f46093dd22969037beb1fce2e043f3236be41c92 a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e git Not specified
CNA Linux Linux affected da3039e91d1f835874ed6e9a33ea19ee80c2cb92 0c561fab50991df10b1e4daca25886c34a2a9c07 git Not specified
CNA Linux Linux affected da3039e91d1f835874ed6e9a33ea19ee80c2cb92 c2744d5f3aea474513fd2298daecb94a952ce441 git Not specified
CNA Linux Linux affected 60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f git Not specified
CNA Linux Linux affected 6.12.94 6.12.103 semver Not specified
CNA Linux Linux affected 6.18.36 6.18.44 semver Not specified
CNA Linux Linux affected 7.0.13 7.1 semver Not specified
CNA Linux Linux affected 7.1 Not specified
CNA Linux Linux unaffected 7.1 semver Not specified
CNA Linux Linux unaffected 6.12.103 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.44 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.8 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc6 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/bb016091010ec401a06e6bdace0cd944ee03d371 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0c561fab50991df10b1e4daca25886c34a2a9c07 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c2744d5f3aea474513fd2298daecb94a952ce441 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report