CVE-2026-80815
Received Received - Intake

Use-After-Free in Linux Kernel ALSA Scarlett2 Driver

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2_init_notify() used mixer->urb, which snd_usb_mixer_status_create() allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that endpoint, the "already in use" check fires on the status URB and returns 0 for success without doing anything. No notification URB is submitted, and cmd_done is left zeroed because it is initialised past that check and nowhere else. scarlett2_usb_init() then issues SCARLETT2_USB_INIT_1 and wait_for_completion_timeout() would crash adding to the zeroed wait.head. Use a separate URB in scarlett2_data, as done for FCP, and initialise cmd_done in scarlett2_init_private(). mixer.c was also freeing the URB in snd_usb_mixer_free() and resubmitting it in snd_usb_mixer_activate(), so scarlett2 must now do both: add scarlett2_cleanup_urb(), called from private_free and private_suspend, and a private_resume callback to re-establish the URB after resume. scarlett2_init_notify() is reached from there, and the URB kill path in scarlett2_notify() completes cmd_done, leaving a stale count that would satisfy the next command's wait before the device ACKs. Use reinit_completion() to clear it. Also free the URB if the transfer buffer allocation fails, and both if usb_submit_urb() fails. Move scarlett2_init_notify() up next to scarlett2_cleanup_urb() so scarlett2_init_private() can reference it without a forward declaration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80815
EUVD
EUVD-2026-71250

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of a USB audio control interface. The issue occurs when the ALSA Scarlett2 driver uses a shared USB Request Block (URB) for notifications, which can lead to race conditions and system crashes due to incorrect URB management.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA Scarlett2 driver and does not have network-based detection methods. To detect it, check if your system is running a vulnerable kernel version using commands like 'uname -a' or 'cat /proc/version'. Look for kernel versions prior to the fix.

Impact Analysis

This vulnerability could cause system instability, including crashes or hangs, when using Scarlett2 audio interfaces. It may lead to audio device malfunctions or kernel panics, disrupting audio functionality on affected systems.

Mitigation Strategies

Update your Linux kernel to the latest patched version. If you are using a distribution with a vulnerable kernel, apply the vendor's security update immediately. Restart your system after updating to ensure the patched kernel is active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80815. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart