CVE-2026-98316: ALSA: bcd2000: Fix race between rawmidi and disconnect
Published Oct 6, 2026
·Updated
ALSA: bcd2000: Fix race between rawmidi and disconnect
Affected Software
1 affected component
Linux Linux kernel
Event History
Oct 6, 2026
CVE Published
via MITRE·08:46 AM
Data Sourced
via MITRE·08:46 AM
Description
Data Sourced
via NVD·09:18 AM
Description
Oct 7, 2026
Data Sourced
via Microsoft·08:29 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems are exposed to this issue?
Systems using the Linux kernel's ALSA bcd2000 driver are relevant. The race involves raw MIDI activity and USB device disconnect handling for that driver.
2
What conditions are needed to trigger the race?
A raw MIDI trigger callback must already be running when USB disconnect handling occurs. An in-flight raw MIDI operation can then access a URB during the disconnect race.
3
How is the issue addressed?
The fix adds a spinlock covering raw MIDI operations and raw MIDI handling in the completion callback. It clears the URB while holding that lock, ensuring pending raw MIDI work has finished or observes a NULL URB.