CVE-2026-74504 ALSA: seq: Fix division by zero in initialize_timer()

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

CVE-2026-74503 ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...

CVE-2026-74503

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...

CVE-2026-74503

In the provided CVE-2026-74503 entries, the Linux kernel ALSA timer issue is resolved: snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and a close can leave an object referenced if reopened mid‑process. The vulnerability concerns ALSA timer handling when closing snd_timer in...

EUVD-2026-59696

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...

CVE-2026-74504 ALSA: seq: Fix division by zero in initialize_timer()

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix division by zero in initializetimer A userspace-driven ALSA timer SNDUTIMER lets an unprivileged user set the backing sndtimer's hardware resolution to an arbitrary 64-bit value via SNDRVTIMERIOCTLCREATE...

CVE-2026-74504

Summary (CVE-2026-74504): The Linux kernel ALSA sequencing timer (SND_UTIMER) can be driven by an unprivileged user to set arbitrary 64‑bit hardware resolution for snd_timer via SNDRV_TIMER_IOCTL_CREATE. When bound to a sequencer queue, initialize_timer() computes tmr->ticks = 1_000_000_000 / ...

CVE-2026-74502 ALSA: ump: fix double free of out_cvts on rawmidi error

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

CVE-2026-74502

The CVE-2026-74502 issue affects the Linux kernel ALSA subsystem (ump) where snd_ump_attach_legacy_rawmidi() allocates ump->out_cvts and frees it on error via kfree(), leaving a stale pointer. If the endpoint is torn down later, snd_ump_endpoint_free() frees ump->out_cvts a second time, cau...

CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

EUVD-2026-59695

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

CVE-2026-74502 ALSA: ump: fix double free of out_cvts on rawmidi error

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

CVE-2026-74501

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...

CVE-2026-74501

CVE-2026-74501 affects the Linux kernel ALSA usb-audio, where create_midi2_ump() stores a back-pointer to a per-interface object in ump->private_data but never clears it or installs a private_free hook. If snd_usb_midi_v2_create() fails, free_all_midi2_umps() frees the object while an already-...

EUVD-2026-59694

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...

CVE-2026-74500 ALSA: usb-audio: fix stack info leak in RME Digiface status

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status sndrmedigifacereadstatus reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does not...

CVE-2026-74500

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status sndrmedigifacereadstatus reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does not...

CVE-2026-74500

CVE-2026-74500 affects the Linux kernel’s ALSA usb-audio for RME Digiface. The issue arises when snd_rme_digiface_read_status() reads a four-word status block into an uninitialised on‑stack buffer and, if the vendor IN transfer isn’t negative, copies all four words to status[]. Additionally, snd_...

CVE-2026-74500 ALSA: usb-audio: fix stack info leak in RME Digiface status

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix stack info leak in RME Digiface status sndrmedigifacereadstatus reads a four-word status block from the device into an uninitialised on-stack le32 buf4 and, whenever the vendor control-IN transfer does not...

CVE-2026-74501 ALSA: usb-audio: fix use-after-free in ump_to_endpoint()

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix use-after-free in umptoendpoint createmidi2ump registers a card-owned sndumpendpoint and stores a back-pointer to its per-interface sndusbmidi2ump object in ump-privatedata, but it never installs an...