CVE-2026-80971

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the ALSA bcd2000 driver. The function bcd2000 free usb related resources() frees USB Request Blocks (URBs) but fails to clear the associated pointers. Because the rawmidi device can outlive this call, a substream remaining open during device unplugging can trigger bcd2000 midi send(), which writes to the freed URB and submits it to the USB core. Additionally, bcd2000 input complete() may resubmit the midi in urb from the completion handler. This flaw can be exploited for local privilege escalation. The issue involves the midi out urb and midi in urb variables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.