UBUNTU-CVE-2026-80816: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcpinitnotify() used mixer->urb, which sndusbmixerstatuscreate() allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device with that endpoint, fcpinitnotify()'s "already set up" early return fires on the status URB and returns success without doing anything. No FCP notification URB is submitted, and cmddone is left zeroed because it is initialised past that early return and nowhere else. fcpinit() then issues init1opcode and waitforcompletiontimeout() would crash adding to the zeroed wait.head. fcpcleanupurb() would also kill and free mixer.c's status URB. Use a separate URB in fcpdata, and initialise cmddone in fcpinitprivate() where fcpdata is allocated. fcpinitnotify() is reached again after suspend via fcpreinit(), and the URB kill path in fcpnotify() completes cmddone, leaving a stale count that would satisfy the next command's wait before the device ACKs. Use reinitcompletion() to clear it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which deployments are most likely to encounter this issue?
The affected Ubuntu kernel packages listed are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0. The failure condition involves a USB audio device that exposes the optional UAC2 status interrupt endpoint.
What device condition triggers the initial failure path?
The problematic path occurs when FCP notification setup is performed on a device with the optional UAC2 status interrupt endpoint. In that case, setup can incorrectly treat the mixer status URB as already configured, leaving the FCP command completion object uninitialized before it is used.
Can the issue also affect a device after suspend and resume?
Yes. FCP notification setup is reached again after suspend through reinitialization, and a stale completion count can cause a subsequent command wait to complete before the device acknowledges the command.