CVE-2026-74504

A flaw was found in the Linux kernel's ALSA sequencer subsystem, assessed by Red Hat Product Security as having moderate impact. An unprivileged local user with access to the ALSA timer and sequencer device nodes (/dev/snd/timer and /dev/snd/seq) can create a userspace-driven ALSA timer (SND_UTIMER) and set its hardware resolution to an arbitrary 64-bit value via SNDRV_TIMER_IOCTL_CREATE. When such a timer is bound to a sequencer queue, the tick period calculation in initialize_timer() divides by the product of that resolution and the queue update frequency; a sufficiently large resolution causes the 64-bit product to overflow and wrap to zero, triggering a division-by-zero fault. Because the fault occurs while a spinlock is held with interrupts disabled, the resulting kernel oops hangs the CPU, causing a system-wide denial of service. There is no impact to the confidentiality or integrity of the system.

The vulnerable userspace-driven ALSA timer code is present in Red Hat Enterprise Linux 9 (from version 9.6 onward) and Red Hat Enterprise Linux 10, as well as Red Hat In-Vehicle OS 2; the kernel and kernel-rt components in those products are affected. Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, and Red Hat Enterprise Linux 9.2 and 9.4 do not contain the vulnerable code and are therefore not affected. Remediation for the affected products is currently deferred to a future update; the residual risk is a local denial of service by an attacker who already has unprivileged local access and permissions on the ALSA timer and sequencer devices.