CVE-2026-80971

A flaw was found in the ALSA bcd2000 driver of the Linux kernel. When a USB device using this driver is disconnected while a rawmidi substream is still active, the driver fails to clear the Universal Serial Bus Request Block (URB) pointers. This oversight allows a local attacker to trigger a use-after-free vulnerability, leading to memory corruption. This can result in a denial of service or potentially arbitrary code execution.

A use-after-free in the ALSA/USB bcd2000 driver can occur after USB disconnect because freed midi_in_urb and midi_out_urb pointers remain reachable from rawmidi and completion paths. A local user or process with access to the rawmidi device can keep a substream open while disconnect handling frees the URBs, after which the close trigger path may write to the freed output URB and submit it to the USB core. For the CVSS the PR:L is used because reliable triggering requires local code execution or a local process context with access to the exposed sound device, not full administrator privileges. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in the paranoid case may include privilege escalation because the bug is a kernel heap use-after-free with a write to freed memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.