CVE-2026-74503: Linux 7.1

Affected technology

Linux · 586b219a22b1032b28b8bd356b963276c5e5bf53 to before bb016091010ec401a06e6bdace0cd944ee03d371, f46093dd22969037beb1fce2e043f3236be41c92 to before a26a2e52736f9e39843ca66a2e1ce6bf1adbcd1e, da3039e91d1f835874ed6e9a33ea19ee80c2cb92 to before 0c561fab50991df10b1e4daca25886c34a2a9c07, da3039e91d1f835874ed6e9a33ea19ee80c2cb92 to before c2744d5f3aea474513fd2298daecb94a952ce441, 60e73ab87b84bbd6bd7ddd1d16019a3a3705ab8f, 6.12.94 to before 6.12.103, 6.18.36 to before 6.18.44, 7.0.13 to before 7.1
Linux

Linux · 7.1
Linux

Component: Not specified by the source
File: sound/core/timer.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

An unprivileged user with access to /dev/snd/timer and /dev/snd/seq can force that failure, since snd_timer_check_master() returns -EBUSY when a pending slave matches the new master's (slave_class, slave_id) key and the target timer has reached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class = SNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a sequencer queue's key can be forged. Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.