UBUNTU-CVE-2026-90207: Null Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in sndrawmidiinputtrigger(): sndrawmidiinputtrigger(up=0) sndmidiinputevent() -> sndrawmidikernelread() -> sndrawmidiinputtrigger(up=1) -> cancelworksync() which ends with the underlying device being active unexpectedly. When this is called from closesubstream(), further input can re-trigger the input event leaving it running after rawmidireleasepriv() has set rfile->rmidi to NULL which leads to: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 Call trace: sndmidiinputevent+0x3c/0x134 [sndseqmidi] (P) sndrawmidiinputeventwork+0x1c/0x2c processonework+0x150/0x3a4 workerthread+0x190/0x318 Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi: Serialize output teardown with eventinput") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1]. With this change in place, midisynthunsubscribe() clears the input file so sndmidiinputevent() will not re-trigger the stream and will be quiesced by the cancelworksync() in sndrawmidiinputtrigger(). [1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/