UBUNTU-CVE-2026-80815: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify() used mixer->urb, which sndusbmixerstatuscreate() allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that endpoint, the "already in use" check fires on the status URB and returns 0 for success without doing anything. No notification URB is submitted, and cmddone is left zeroed because it is initialised past that check and nowhere else. scarlett2usbinit() then issues SCARLETT2USBINIT1 and waitforcompletiontimeout() would crash adding to the zeroed wait.head. Use a separate URB in scarlett2data, as done for FCP, and initialise cmddone in scarlett2initprivate(). mixer.c was also freeing the URB in sndusbmixerfree() and resubmitting it in sndusbmixeractivate(), so scarlett2 must now do both: add scarlett2cleanupurb(), called from privatefree and privatesuspend, and a privateresume callback to re-establish the URB after resume. scarlett2initnotify() is reached from there, and the URB kill path in scarlett2notify() completes cmddone, leaving a stale count that would satisfy the next command's wait before the device ACKs. Use reinitcompletion() to clear it. Also free the URB if the transfer buffer allocation fails, and both if usbsubmiturb() fails. Move scarlett2initnotify() up next to scarlett2cleanupurb() so scarlett2initprivate() can reference it without a forward declaration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update the Linux ALSA scarlett2 driver to use a separate private URB for the notification endpoint, initialize cmd_done in scarlett2_init_private() with reinit_completion(), and submit the private URB rather than reusing mixer->urb.
- Compensating control
Update scarlett2 URB lifecycle handling to free the transfer buffer's URB on allocation failure, free both resources if usb_submit_urb() fails, add scarlett2_cleanup_urb() from private_free and private_suspend, and re-establish the URB through a private_resume callback.