CVE-2026-80971

In the Linux kernel, the following vulnerability has been resolved:

ALSA: bcd2000: clear the URB pointers on disconnect

bcd2000 free usb related resources() frees both URBs and leaves the pointers behind:

usb kill urb(bcd2k->midi out urb);
usb kill urb(bcd2k->midi in urb);

usb free urb(bcd2k->midi out urb);
usb free urb(bcd2k->midi in urb);

The rawmidi device outlives that call. A substream that is still open when the device is unplugged reaches bcd2000 midi send() from the trigger path on close. That function writes to the freed URB and then hands it to the USB core:

bcd2k->midi out urb->transfer buffer length = BUFSIZE;
...
ret = usb submit urb(bcd2k->midi out urb, GFP ATOMIC);

usb kill urb() does not stop a later submission either, so a submit that races the disconnect can requeue the URB after it has been reaped. midi in urb is exposed the same way: bcd2000 input complete() resubmits it from the completion handler.

KASAN on 7.2.0-rc5 (arm64):

BUG: KASAN: slab-use-after-free in bcd2000 midi send [snd bcd2000] Write of size 4 at addr ffff00001827d388 by task bpoc/168 asan store4 bcd2000 midi send [snd bcd2000] bcd2000 midi output trigger [snd bcd2000] snd rawmidi kernel write1 close substream.part.0 Freed by task 168: usb free urb bcd2000 disconnect [snd bcd2000]

BUG: KASAN: slab-use-after-free in usb submit urb Read of size 8 at addr ffff00001827d3b8 by task bpoc/168

Clear both pointers after freeing and test them on the paths that can still run. Poison the URBs before freeing them: usb poison urb() waits for a running completion handler and rejects any later submission, so after it returns the input path is quiesced and only the rawmidi trigger path can still reach bcd2000 midi send(). No unpoison is needed; the URBs are freed on the next line.

Discovered by XBOW, triaged by Baul Lee baul.lee@xbow.com