CVE-2026-80971: ALSA: bcd2000: clear the URB pointers on disconnect
Published Sep 11, 2026
·Updated
ALSA: bcd2000: clear the URB pointers on disconnect
Affected Software
1 affected component
Linux kernel ALSA bcd2000 driver (snd_bcd2000)=7.2.0-rc5
Event History
Sep 11, 2026
CVE Published
via MITRE·07:42 PM
Data Sourced
via MITRE·07:42 PM
DescriptionSeverity
Data Sourced
via NVD·08:19 PM
DescriptionSeverity
Sep 13, 2026
Data Sourced
via Microsoft·08:07 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Systems using the Linux kernel's ALSA bcd2000 driver (snd_bcd2000) are exposed when a rawmidi substream remains open while the associated USB device is disconnected.
2
What condition is needed to trigger the use-after-free?
The BCD2000 USB device must be unplugged while a rawmidi substream is still open. A later output trigger during close can access and submit a freed MIDI output URB; the MIDI input URB can also be resubmitted from its completion handler.
3
How can this issue be detected during investigation?
A KASAN-enabled kernel may report a slab-use-after-free in bcd2000_midi_send, with bcd2000_midi_output_trigger and snd_rawmidi_kernel_write1 in the call trace. The reported failure occurs after device disconnect with an open rawmidi substream.