{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74503 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74503 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74503 and fix it if it is affected.\n\nWhat it is: CVE-2026-74503 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74503 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74503/ (Markdown: https://insights.sbomify.com/CVE-2026-74503/index.md)","id":"CVE-2026-74503","markdown":"https://insights.sbomify.com/CVE-2026-74503/index.md","name":"CVE-2026-74503","record":{"aliases":["BELL-CVE-2026-74503","DEBIAN-CVE-2026-74503","GHSA-mwmj-cw5c-jg28","UBUNTU-CVE-2026-74503"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel ALSA","requires_auth":"low_privilege","summary":"An unprivileged user can trigger a use-after-free in the Linux kernel ALSA timer subsystem, potentially leading to code execution or privilege escalation.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes\n\nsnd_timer_close_locked() marks an instance with SNDRV_TIMER_IFLG_DEAD\nand returns early when the flag is already set, but the flag is never\ncleared again.  A completed close ends in remove_slave_links(), which\nleaves timeri-\u003etimer NULL, so a second close is already harmless through\nthe timer == NULL path; the early return can only be reached by an\ninstance that was opened again in between.  For such an instance the\nclose unlinks nothing, so snd_timer_instance_free() frees an object that\nis still on timer-\u003eopen_list_head, still on snd_timer_master_list if it\nwas opened with a slave key, still owns any adopted slaves, and still\nholds its timer and module references.\n\nsnd_seq_timer_open() reopens an instance exactly like that: it retries\nits fallback open on the same object after a failure that has already\nrun snd_timer_close_locked() internally.  An unprivileged user with\naccess to /dev/snd/timer and /dev/snd/seq can force that failure, since\nsnd_timer_check_master() returns -EBUSY when a pending slave matches the\nnew master's (slave_class, slave_id) key and the target timer has\nreached max_instances, and SNDRV_TIMER_IOCTL_SELECT with dev_class =\nSNDRV_TIMER_CLASS_SLAVE keeps the caller-supplied dev_sclass, so a\nsequencer queue's key can be forged.  The freed instance is afterwards\ndereferenced by any further snd_timer_open() on that timer, by\nsnd_timer_check_slave(), and by /proc/asound/timers, which faults on the\nstale ti-\u003eowner pointer.\n\nThe flag only has to be visible while the close is in progress, which is\nall its other users need.  Clear it in remove_slave_links(), under the\nsame timer-\u003elock that sets it, once the instance is off every list.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes","id":"CVE-2026-74503","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":4,"next":{"headline":"ALSA: seq: Fix division by zero in initialize_timer()","id":"CVE-2026-74504"},"packages":[],"prev":{"headline":"ALSA: ump: fix double free of out_cvts on rawmidi error","id":"CVE-2026-74502"},"products":["Linux"],"published":"2026-08-15","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Linux"]},"summary":"An unprivileged user can trigger a use-after-free in the Linux kernel ALSA timer subsystem, potentially leading to code execution or privilege escalation.","url":"https://insights.sbomify.com/CVE-2026-74503/"}