CVE-2026-80816

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) FireWire Control Protocol (FCP) driver. Incorrect handling of the Universal Serial Bus Request Block (URB) for the notification endpoint could lead to a system crash. This occurs because the fcp_init_notify() function uses a shared URB, which can result in a zeroed wait head and subsequent system instability, potentially causing a denial of service (DoS).

An ALSA USB FCP initialization bug can occur when the driver shares the mixer status URB instead of using a private FCP notification URB. On a device that exposes the optional UAC2 status interrupt endpoint, fcp_init_notify can return success without submitting the FCP notification URB and cmd_done may remain uninitialized, causing a kernel crash when fcp_init waits for command completion. For the CVSS the PR:N because a malicious USB device can trigger the vulnerable path without host privileges if it can be attached to the target system. The issue is not network reachable and normally requires physical USB access or a passed through USB device. Impact is at least denial of service via kernel crash, with limited confidentiality or integrity risk considered in the paranoid score due to possible wrong URB ownership and stale pointer behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.