CVE-2026-98086

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ump: do not touch legacy rmidi before it exists

snd ump parse endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump handle ep name msg() then treats parsed as "legacy rmidi is live" and calls ump legacy set rawmidi name(), which snprintf()s into ump->legacy rmidi->name. If a UMP packet arrives in that window (IRQ path from snd ump receive), legacy rmidi is still NULL (KASAN null-ptr-deref in snprintf).

Guard the legacy helpers. parsed only means endpoint info was parsed, not that legacy rmidi exists.