CVE-2026-80971: ALSA: bcd2000: clear the URB pointers on disconnect

In the Linux kernel, the following vulnerability has been resolved:

ALSA: bcd2000: clear the URB pointers on disconnect

bcd2000freeusbrelatedresources() frees both URBs and leaves the pointers behind:

usbkillurb(bcd2k->midiouturb); usbkillurb(bcd2k->midiinurb);

usbfreeurb(bcd2k->midiouturb); usbfreeurb(bcd2k->midiinurb);

The rawmidi device outlives that call. A substream that is still open when the device is unplugged reaches bcd2000midisend() from the trigger path on close. That function writes to the freed URB and then hands it to the USB core:

bcd2k->midiouturb->transferbufferlength = BUFSIZE; ... ret = usbsubmiturb(bcd2k->midiouturb, GFPATOMIC);

usbkillurb() does not stop a later submission either, so a submit that races the disconnect can requeue the URB after it has been reaped. midiinurb is exposed the same way: bcd2000inputcomplete() resubmits it from the completion handler.

KASAN on 7.2.0-rc5 (arm64):

BUG: KASAN: slab-use-after-free in bcd2000midisend [sndbcd2000] Write of size 4 at addr ffff00001827d388 by task bpoc/168 asanstore4 bcd2000midisend [sndbcd2000] bcd2000midioutputtrigger [sndbcd2000] sndrawmidikernelwrite1 closesubstream.part.0 Freed by task 168: usbfreeurb bcd2000disconnect [sndbcd2000]

BUG: KASAN: slab-use-after-free in usbsubmiturb Read of size 8 at addr ffff00001827d3b8 by task bpoc/168

Clear both pointers after freeing and test them on the paths that can still run. Poison the URBs before freeing them: usbpoisonurb() waits for a running completion handler and rejects any later submission, so after it returns the input path is quiesced and only the rawmidi trigger path can still reach bcd2000midisend(). No unpoison is needed; the URBs are freed on the next line.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>