CVE-2026-90207

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ALSA sequencer MIDI component where the snd midi input event() function can run while a rawmidi substream is closing. This creates a race condition in snd rawmidi input trigger() that can leave the underlying device active unexpectedly. If this occurs during close substream(), subsequent input may re-trigger the input event after rawmidi release priv() has set the rmidi variable to NULL, resulting in a kernel NULL pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.