CVE-2026-80815

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.5-1.1

Description An issue exists in the ALSA scarlett2 component where the scarlett2 init notify() function incorrectly uses mixer->urb, which is allocated by snd usb mixer status create() for the UAC2 status interrupt endpoint. On devices with this endpoint, a check for the URB being already in use triggers, causing the function to return success without submitting a notification URB. Consequently, the cmd done variable remains zeroed. When scarlett2 usb init() issues SCARLETT2 USB INIT 1, the wait for completion timeout() function may crash while attempting to add to the zeroed wait.head. Additionally, the URB kill path in scarlett2 notify() can leave a stale count in cmd done, potentially satisfying a subsequent command's wait before the device acknowledges.

Recommendations Update the Linux kernel to version 7.2.5-1.1 or later.