SECUFOCUSNOW
Home›CVE index›CVE-2026-74503
ReviewHigh

CVE-2026-74503

Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close ends in remove_slave_links(), which leaves timeri->timer NULL, so a second close is already harmless through the timer == NULL path; the early return can only be reached by an instance that was opened again in between. For such an instance the close unlinks nothing, so snd_timer_instance_f...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.08.15
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes snd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close ends in remove_slave_links(), which leaves timeri->timer NULL, so a second close is already harmless through the timer == NULL path; the early return can only be reached by an instance that was opened again in between. For such an instance the close unlinks nothing, so snd_timer_instance_f...

Affected product and versions

Product
Linux
Affected versions
>= 586b219a22b1032b28b8bd356b963276c5e5bf53 < bb016091010ec401a06e6bdace0cd944ee03d371, >= f46093dd22969037beb1fce2e043f3236be41c92 < a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e, >= da3039e91d1f835874ed6e9a33ea19ee80c2cb92 < 0c561fab50991df10b1e4daca25886c34a2a9c07, >= da3039e91d1f835874ed6e9a33ea19ee80c2cb92 < c2744d5f3aea474513fd2298daecb94a952ce441, >= 60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f, >= 6.12.94 < 6.12.103, >= 6.18.36 < 6.18.44, >= 7.0.13 < 7.1, >= 7.1
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available