CVE-2026-74503 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close ends in remove_slave_links(), which leaves timeri->timer NULL, so a second close is already harmless through the timer == NULL path; the early return can only be reached by an instance that was opened again in between. For such an instance the close unlinks nothing, so snd_timer_instance_free() frees an object that is still on timer->open_list_head, still on snd_timer_master_list if it was opened with a slave key, still owns any adopted slaves, and still holds its timer and module references.
snd_seq_timer_open() reopens an instance exactly like that: it retries its fallback open on the same object after a failure that has already run snd_timer_close_locked() internally. An unprivileged user with access to /dev/snd/timer and /dev/snd/seq can force that failure, since snd_timer_check_master() returns -EBUSY when a pending slave matches the new master's (slave_class, slave_id) key and the target timer has reached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class = SNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a sequencer queue's key can be forged. The freed instance is afterwards dereferenced by any further snd_timer_open() on that timer, by snd_timer_check_slave(), and by /proc/asound/timers, which faults on the stale ti->owner pointer.
The flag only has to be visible while the close is in progress, which is all its other users need. Clear it in remove_slave_links(), under the same timer->lock that sets it, once the instance is off every list.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within the Linux kernel's Advanced Linux Sound Architecture implementation, specifically in the timer subsystem where improper handling of timer instance lifecycle management creates a use-after-free condition. The flaw manifests when an ALSA timer instance is closed and subsequently reopened, with the SNDRV_TIMER_IFLG_DEAD flag being set but never cleared after the close operation completes. This oversight allows for continued references to freed memory structures, creating potential for system instability or privilege escalation.
The technical root cause stems from the snd_timer_close_locked() function which correctly sets the SNDRV_TIMER_IFLG_DEAD flag to prevent re-entrancy during closure operations. However, this flag remains set even after the close operation completes successfully, leading to improper state management within the timer subsystem. When a timer instance is closed and then reopened through snd_seq_timer_open(), the system can attempt to access freed memory structures that are still referenced in various kernel lists including timer->open_list_head and snd_timer_master_list.
The operational impact of this vulnerability becomes apparent when considering the attack vectors available to unprivileged users with access to specific ALSA device files. An attacker can exploit the weakness by creating a sequence timer that triggers a failure condition during the opening process, which then calls snd_timer_close_locked() internally. Through careful manipulation of the slave class and id parameters in SNDRV_TIMER_IOCTL_SELECT operations, attackers can forge sequencer queue keys to force the specific failure scenario that leads to memory corruption.
The vulnerability specifically affects the relationship between timer instances and their master/slave associations within the ALSA subsystem. When remove_slave_links() executes after a timer close operation, it properly removes the timer instance from various lists but fails to clear the SNDRV_TIMER_IFLG_DEAD flag. This leaves the freed structure in an inconsistent state where it appears to be closed but still maintains references that can lead to memory corruption.
The flaw demonstrates poor resource management practices in kernel code and represents a classic use-after-free vulnerability pattern that could potentially be exploited for privilege escalation. The issue affects the ALSA timer subsystem's ability to properly manage concurrent access to timer resources, particularly when dealing with master-slave timer relationships. This vulnerability directly relates to CWE-415 which describes double free conditions and CWE-416 which covers use after free errors in memory management.
The mitigation strategy involves ensuring proper flag clearing within the remove_slave_links() function under the same timer->lock that sets it, guaranteeing that the SNDRV_TIMER_IFLG_DEAD flag is cleared only after the timer instance has been completely removed from all relevant kernel lists. This approach follows proper resource management principles where flags should only remain set during the duration of their intended use case. The fix ensures that the timer instance state becomes consistent immediately after all references are properly cleared, preventing any further access to freed memory structures.
This vulnerability highlights the critical importance of proper synchronization and resource cleanup in kernel subsystems, particularly those handling multimedia device interfaces where multiple processes may interact with shared timer resources. The attack scenario requires specific access permissions but demonstrates how seemingly minor state management issues can compound into serious security concerns within complex kernel subsystems that handle real-time audio processing requirements.