CVE-2026-80815

In the Linux kernel, the following vulnerability has been resolved:

ALSA: scarlett2: Use a private URB for the notification endpoint

scarlett2 init notify() used mixer->urb, which snd usb mixer status create() allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that endpoint, the "already in use" check fires on the status URB and returns 0 for success without doing anything. No notification URB is submitted, and cmd done is left zeroed because it is initialised past that check and nowhere else. scarlett2 usb init() then issues SCARLETT2 USB INIT 1 and wait for completion timeout() would crash adding to the zeroed wait.head.

Use a separate URB in scarlett2 data, as done for FCP, and initialise cmd done in scarlett2 init private(). mixer.c was also freeing the URB in snd usb mixer free() and resubmitting it in snd usb mixer activate(), so scarlett2 must now do both: add scarlett2 cleanup urb(), called from private free and private suspend, and a private resume callback to re-establish the URB after resume. scarlett2 init notify() is reached from there, and the URB kill path in scarlett2 notify() completes cmd done, leaving a stale count that would satisfy the next command's wait before the device ACKs. Use reinit completion() to clear it.

Also free the URB if the transfer buffer allocation fails, and both if usb submit urb() fails. Move scarlett2 init notify() up next to scarlett2 cleanup urb() so scarlett2 init private() can reference it without a forward declaration.