CVE-2026-74504

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) sequencer component. An unprivileged local user with access to ALSA timer and sequencer devices can trigger a division-by-zero error. This occurs by manipulating the ALSA timer's hardware resolution, leading to an integer overflow during a calculation, which results in a system hang and a Denial of Service.

A flaw was found in the Linux kernel's ALSA sequencer subsystem, assessed by Red Hat Product Security as having moderate impact. An unprivileged local user with access to the ALSA timer and sequencer device nodes (/dev/snd/timer and /dev/snd/seq) can create a userspace-driven ALSA timer (SND_UTIMER) and set its hardware resolution to an arbitrary 64-bit value via SNDRV_TIMER_IOCTL_CREATE. When such a timer is bound to a sequencer queue, the tick period calculation in initialize_timer() divides by the product of that resolution and the queue update frequency; a sufficiently large resolution causes the 64-bit product to overflow and wrap to zero, triggering a division-by-zero fault. Because the fault occurs while a spinlock is held with interrupts disabled, the resulting kernel oops hangs the CPU, causing a system-wide denial of service. There is no impact to the confidentiality or integrity of the system.

The vulnerable userspace-driven ALSA timer code is present in Red Hat Enterprise Linux 9 (from version 9.6 onward) and Red Hat Enterprise Linux 10, as well as Red Hat In-Vehicle OS 2; the kernel and kernel-rt components in those products are affected. Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Red Hat Enterprise Linux 9.2 and 9.4 do not contain the vulnerable code and are therefore not affected. Remediation for the affected products is currently deferred to a future update; the residual risk is a local denial of service by an attacker who already has unprivileged local access and permissions on the ALSA timer and sequencer devices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.