In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: midi: Serialize input teardown with eventinput

sndmidiinputevent() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in sndrawmidiinputtrigger():

sndrawmidiinputtrigger(up=0) sndmidiinputevent() -> sndrawmidikernelread() -> sndrawmidiinputtrigger(up=1) -> cancelworksync()

which ends with the underlying device being active unexpectedly.

When this is called from closesubstream(), further input can re-trigger the input event leaving it running after rawmidireleasepriv() has set rfile->rmidi to NULL which leads to:

Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 Call trace: sndmidiinputevent+0x3c/0x134 [sndseqmidi] (P) sndrawmidiinputeventwork+0x1c/0x2c processonework+0x150/0x3a4 workerthread+0x190/0x318

Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi: Serialize output teardown with eventinput") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1].

With this change in place, midisynthunsubscribe() clears the input file so sndmidiinputevent() will not re-trigger the stream and will be quiesced by the cancelworksync() in sndrawmidiinputtrigger().

[1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/