CVE-2026-98316: ALSA: bcd2000: Fix race between rawmidi and disconnect
ALSA: bcd2000: Fix race between rawmidi and disconnect
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.189 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's ALSA bcd2000 driver are relevant. The race involves raw MIDI activity and USB device disconnect handling for that driver.
What conditions are needed to trigger the race?
A raw MIDI trigger callback must already be running when USB disconnect handling occurs. An in-flight raw MIDI operation can then access a URB during the disconnect race.
How is the issue addressed?
The fix adds a spinlock covering raw MIDI operations and raw MIDI handling in the completion callback. It clears the URB while holding that lock, ensuring pending raw MIDI work has finished or observes a NULL URB.