CVE-2026-80816: ALSA: FCP: Use a private URB for the notification endpoint

Published Sep 4, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ALSA: FCP: Use a private URB for the notification endpoint

fcpinitnotify() used mixer->urb, which sndusbmixerstatuscreate() allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device with that endpoint, fcpinitnotify()'s "already set up" early return fires on the status URB and returns success without doing anything. No FCP notification URB is submitted, and cmddone is left zeroed because it is initialised past that early return and nowhere else. fcpinit() then issues init1opcode and waitforcompletiontimeout() would crash adding to the zeroed wait.head. fcpcleanupurb() would also kill and free mixer.c's status URB.

Use a separate URB in fcpdata, and initialise cmddone in fcpinitprivate() where fcpdata is allocated. fcpinitnotify() is reached again after suspend via fcpreinit(), and the URB kill path in fcpnotify() completes cmddone, leaving a stale count that would satisfy the next command's wait before the device ACKs. Use reinitcompletion() to clear it.

Event History

Sep 4, 2026
CVE Published
via MITRE·03:13 PM
Data Sourced
via MITRE·03:13 PM
Description

Frequently Asked Questions

1

Which systems are affected by this issue?

The affected path is reached on Linux systems using the ALSA FCP driver with a device that has the optional UAC2 status interrupt endpoint. In that configuration, the FCP notification setup can mistakenly reuse the mixer status URB.

2

What can happen when the vulnerable path is triggered?

During FCP initialization, the completion object can remain uninitialized, and waiting for the initialization command can crash. The cleanup path can also kill and free the mixer component's status URB.

3

Does suspend and resume affect the behavior?

Yes. The notification setup is reached again after suspend through FCP reinitialization; a stale completion count can cause a later command wait to succeed before the device acknowledges the command.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203