CVE-2026-74504: ALSA: seq: Fix division by zero in initialize_timer()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: Fix division by zero in initialize_timer()

A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set
the backing snd_timer's hardware resolution to an arbitrary 64-bit value
via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.

When such a timer is bound to a sequencer queue, initialize_timer()
computes the tick period as

	tmr->ticks = 1000000000 / (r * freq);

where r is that user-controlled resolution and freq is the sequencer
update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).
A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for
any even freq, including DEFAULT_FREQUENCY (1000), so the division faults
with a divide-by-zero.

The division runs under tmr->lock with interrupts disabled, so the oops
leaves the spinlock held and hangs the CPU. It is reachable by an
unprivileged user with access to /dev/snd/timer and /dev/snd/seq.

  Oops: divide error: 0000 [#1] SMP KASAN PTI
  CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+
  RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0
   snd_seq_timer_start+0x15e/0x2b0
   snd_seq_control_queue+0x56f/0xba0
   snd_seq_write+0x3e0/0x730

Reject an overflowing product with check_mul_overflow() and fall back to
a single tick, which also avoids feeding a wrapped-but-nonzero divisor
(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small
value) into the period computation.

The Linux kernel CVE team has assigned CVE-2026-74504 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit 37745918e0e7575bc40f38da93a99b9fa6406224 and fixed in 6.12.103 with commit d0e19932875746118e298b4c974f3b2d4aeb16fc
	Issue introduced in 6.12 with commit 37745918e0e7575bc40f38da93a99b9fa6406224 and fixed in 6.18.44 with commit 5260e195c53e898a4a76527d4bb2178f31795e78
	Issue introduced in 6.12 with commit 37745918e0e7575bc40f38da93a99b9fa6406224 and fixed in 7.1.8 with commit 42c6543ff27ea280334244458d4f52ec7133cc05
	Issue introduced in 6.12 with commit 37745918e0e7575bc40f38da93a99b9fa6406224 and fixed in 7.2-rc6 with commit 21e19688433452dfbbbe6b2bb670dea6eb92f0f6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74504
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/core/seq/seq_timer.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d0e19932875746118e298b4c974f3b2d4aeb16fc
	https://git.kernel.org/stable/c/5260e195c53e898a4a76527d4bb2178f31795e78
	https://git.kernel.org/stable/c/42c6543ff27ea280334244458d4f52ec7133cc05
	https://git.kernel.org/stable/c/21e19688433452dfbbbe6b2bb670dea6eb92f0f6