CVE-2026-80816
Received Received - Intake

Use-After-Free in Linux Kernel ALSA FCP

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create() allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device with that endpoint, fcp_init_notify()'s "already set up" early return fires on the status URB and returns success without doing anything. No FCP notification URB is submitted, and cmd_done is left zeroed because it is initialised past that early return and nowhere else. fcp_init() then issues init1_opcode and wait_for_completion_timeout() would crash adding to the zeroed wait.head. fcp_cleanup_urb() would also kill and free mixer.c's status URB. Use a separate URB in fcp_data, and initialise cmd_done in fcp_init_private() where fcp_data is allocated. fcp_init_notify() is reached again after suspend via fcp_reinit(), and the URB kill path in fcp_notify() completes cmd_done, leaving a stale count that would satisfy the next command's wait before the device ACKs. Use reinit_completion() to clear it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80816
EUVD
EUVD-2026-71251

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of USB audio control (UAC) endpoints. A function called fcp_init_notify() incorrectly reused a USB Request Block (URB) allocated for status interrupts, leading to a failure to properly initialize FireWire Control Protocol (FCP) notifications. This caused a zeroed wait queue head, which later triggered a crash when adding to the wait queue.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA FCP (Function Control Protocol) handling and does not have direct network detection methods. To check for affected systems, inspect the kernel version and ALSA components using commands like 'uname -a' and 'lsmod | grep snd_usb_mixer'. If the kernel version is vulnerable, update it immediately.

Impact Analysis

If you use a Linux system with USB audio devices, this vulnerability could cause system crashes when interacting with certain audio devices. It may lead to unexpected kernel panics or freezes, disrupting audio functionality and potentially causing data loss.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-80816. This vulnerability affects the ALSA FCP module and requires kernel updates to resolve the URB handling issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80816. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart