CVE-2026-74503

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes

snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD

and returns early when the flag is already set, but the flag is never

cleared again. A completed close ends in remove_slave_links(), which

leaves timeri->timer NULL, so a second close is already harmless through

the timer == NULL path; the early return can only be reached by an

instance that was opened again in between. For such an instance the

close unlinks nothing, so snd_timer_instance_free() frees an object that

is still on timer->open_list_head, still on snd_timer_master_list if it

was opened with a slave key, still owns any adopted slaves, and still

holds its timer and module references.

snd_seq_timer_open() reopens an instance exactly like that: it retries

its fallback open on the same object after a failure that has already

run snd_timer_close_locked() internally. An unpr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References