CVE-2026-98316 (GCVE-0-2026-98316)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been already running at USB disconnect handling, the in-flight function (e.g. bcd2000_midi_send()) could still access the URB, because the previous URB NULL-check & clearance was considered only for the URB complete callbacks, but not about the parallel rawmidi operations. For addressing the race, this patch introduced a new spinlock that covers each rawmidi operation as well as the rawmidi handling in the complete callback. The URB is cleared with the lock, so it guarantees that the pending rawmidi task already finished or a NULL check is effective.
References
Impacted products
Vendor Product Version
Linux Linux Version: 3c00004f134fc819f9d9e202c6a64acde0a1f8d0
Version: 6c07aad8a7c9ef8ebc4d03a964b882123a349a2e
Version: eb482a06791d6168beb8c78cc904ac5a5ed96a55
Version: 7df3194bdb7479cad9199889655a566a2c0c1d1b
Version: b06ebc7fe25a6af4a9f6e4a3d4236a4178ad4b01
Version: 459d3a64766f5ca2f1886daeaf24582831a5f5ab
Version: 9af08677aa57debaca5b57c8045c52a83d3dd376
Version: 5a77febac6faf6da40fbb4555f703eeb91b58130
Version: 5.10.270   ≤
Version: 5.15.221   ≤
Create a notification for this product.
   Linux Linux Version: 6.1.188   ≤
Version: 6.6.157   ≤
Version: 6.12.109   ≤
Version: 6.18.50   ≤
Version: 7.2.4   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/bcd2000/bcd2000.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b824930259d54f5047ce6b5c97bd20db2fc2b98",
              "status": "affected",
              "version": "3c00004f134fc819f9d9e202c6a64acde0a1f8d0",
              "versionType": "git"
            },
            {
              "lessThan": "c83d6b0a65f7b71bbabcc91c045dfbffdff6ae76",
              "status": "affected",
              "version": "6c07aad8a7c9ef8ebc4d03a964b882123a349a2e",
              "versionType": "git"
            },
            {
              "lessThan": "0a7ecf52cb59ed77ec525deb52c496ea8fba10b1",
              "status": "affected",
              "version": "eb482a06791d6168beb8c78cc904ac5a5ed96a55",
              "versionType": "git"
            },
            {
              "lessThan": "812ca56867bec3065c2a27f1ff5ce04e2a8bf4f0",
              "status": "affected",
              "version": "7df3194bdb7479cad9199889655a566a2c0c1d1b",
              "versionType": "git"
            },
            {
              "lessThan": "9c8b6eff6e7505c128b615d9a1364ef66fa5c18e",
              "status": "affected",
              "version": "b06ebc7fe25a6af4a9f6e4a3d4236a4178ad4b01",
              "versionType": "git"
            },
            {
              "lessThan": "221253723dc58bb901c3f27a7659823e63fc598c",
              "status": "affected",
              "version": "459d3a64766f5ca2f1886daeaf24582831a5f5ab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9af08677aa57debaca5b57c8045c52a83d3dd376",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a77febac6faf6da40fbb4555f703eeb91b58130",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.221",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/bcd2000/bcd2000.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.189",
              "status": "affected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.158",
              "status": "affected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.112",
              "status": "affected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.54",
              "status": "affected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2.8",
              "status": "affected",
              "version": "7.2.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "6.1.188",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "6.6.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.12.109",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "6.18.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "7.2.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.270",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.221",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: bcd2000: Fix race between rawmidi and disconnect\n\nAlthough we tried to fix the potential UAF issues at USB disconnect on\nbcd2000 driver, there is still an overlooked case -- namely, when a\nrawmidi trigger callback has been already running at USB disconnect\nhandling, the in-flight function (e.g. bcd2000_midi_send()) could\nstill access the URB, because the previous URB NULL-check \u0026 clearance\nwas considered only for the URB complete callbacks, but not about the\nparallel rawmidi operations.\n\nFor addressing the race, this patch introduced a new spinlock that\ncovers each rawmidi operation as well as the rawmidi handling in the\ncomplete callback.  The URB is cleared with the lock, so it guarantees\nthat the pending rawmidi task already finished or a NULL check is\neffective."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:17:26.993Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b824930259d54f5047ce6b5c97bd20db2fc2b98"
        },
        {
          "url": "https://git.kernel.org/stable/c/c83d6b0a65f7b71bbabcc91c045dfbffdff6ae76"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a7ecf52cb59ed77ec525deb52c496ea8fba10b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/812ca56867bec3065c2a27f1ff5ce04e2a8bf4f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c8b6eff6e7505c128b615d9a1364ef66fa5c18e"
        },
        {
          "url": "https://git.kernel.org/stable/c/221253723dc58bb901c3f27a7659823e63fc598c"
        }
      ],
      "title": "ALSA: bcd2000: Fix race between rawmidi and disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98316",
    "datePublished": "2026-10-06T08:46:11.528Z",
    "dateReserved": "2026-09-25T10:25:14.339Z",
    "dateUpdated": "2026-10-19T09:17:26.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.