{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-80971",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-80971"
  ],
  "published": "2026-09-11T19:47:07Z",
  "summary": "ALSA: bcd2000: clear the URB pointers on disconnect",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: bcd2000: clear the URB pointers on disconnect\n\nbcd2000_free_usb_related_resources() frees both URBs and leaves the\npointers behind:\n\n\tusb_kill_urb(bcd2k->midi_out_urb);\n\tusb_kill_urb(bcd2k->midi_in_urb);\n\n\tusb_free_urb(bcd2k->midi_out_urb);\n\tusb_free_urb(bcd2k->midi_in_urb);\n\nThe rawmidi device outlives that call.  A substream that is still open\nwhen the device is unplugged reaches bcd2000_midi_send() from the\ntrigger path on close.  That function writes to the freed URB and then\nhands it to the USB core:\n\n\tbcd2k->midi_out_urb->transfer_buffer_length = BUFSIZE;\n\t...\n\tret = usb_submit_urb(bcd2k->midi_out_urb, GFP_ATOMIC);\n\nusb_kill_urb() does not stop a later submission either, so a submit that\nraces the disconnect can requeue the URB after it has been reaped.\nmidi_in_urb is exposed the same way: bcd2000_input_complete() resubmits\nit from the completion handler.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n  BUG: KASAN: slab-use-after-free in bcd2000_midi_send [snd_bcd2000]\n  Write of size 4 at addr ffff00001827d388 by task bpoc/168\n   __asan_store4\n   bcd2000_midi_send [snd_bcd2000]\n   bcd2000_midi_output_trigger [snd_bcd2000]\n   snd_rawmidi_kernel_write1\n   close_substream.part.0\n  Freed by task 168:\n   usb_free_urb\n   bcd2000_disconnect [snd_bcd2000]\n\n  BUG: KASAN: slab-use-after-free in usb_submit_urb\n  Read of size 8 at addr ffff00001827d3b8 by task bpoc/168\n\nClear both pointers after freeing and test them on the paths that can\nstill run.  Poison the URBs before freeing them: usb_poison_urb() waits\nfor a running completion handler and rejects any later submission, so\nafter it returns the input path is quiesced and only the rawmidi trigger\npath can still reach bcd2000_midi_send().  No unpoison is needed; the\nURBs are freed on the next line.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-80971"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9af08677aa57debaca5b57c8045c52a83d3dd376"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5a77febac6faf6da40fbb4555f703eeb91b58130"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3c00004f134fc819f9d9e202c6a64acde0a1f8d0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6c07aad8a7c9ef8ebc4d03a964b882123a349a2e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/eb482a06791d6168beb8c78cc904ac5a5ed96a55"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7df3194bdb7479cad9199889655a566a2c0c1d1b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b06ebc7fe25a6af4a9f6e4a3d4236a4178ad4b01"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/459d3a64766f5ca2f1886daeaf24582831a5f5ab"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-14T12:06:03Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The UAF is reached locally by USBDEVFS_DISCONNECT (or sysfs unbind) on an already-bound Behringer BCD2000 while /dev/snd/midi* is held, then close; there is no network or packet path. This matches AV:L scoring of analogous USB disconnect UAFs (CVE-2025-40283, CVE-2026-64585); physical unplug is only an extra path.\nAC:L - The attacker opens the rawmidi node, optionally enables active sensing, then issues USBDEVFS_DISCONNECT and close; close_substream deterministically writes the freed URB in bcd2000_midi_send(). Concurrent write versus disconnect is also attacker-driven. No uncontrollable race or layout is required to trigger the UAF.\nPR:L - USBDEVFS_DISCONNECT has no capable() check, only write access to /dev/bus/usb that udev uaccess/plugdev rules grant seat users, and snd_rawmidi_open has no capability gate on /dev/snd/midi*. An unprivileged local account suffices; init-namespace root is not required.\nUI:N - The attacker performs open, disconnect, and close on their own fds against an already-attached BCD2000 (DJ workstation/kiosk). No separate victim action such as plugging a device or clicking is required during exploitation.\nS:U - The slab use-after-free of struct urb and the subsequent usb_submit_urb run entirely in the host kernel. This is ordinary local privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - KASAN shows a use-after-free read in usb_submit_urb of the dangling midi_out_urb after usb_free_urb. Reclaiming the URB slab lets the attacker supply URB fields that the USB core then reads, enabling kernel disclosure, as with other heap UAFs.\nI:H - bcd2000_midi_send() writes transfer_buffer_length on the freed URB and then submits it. A reclaimed fake URB plus usb_submit_urb is a heap write and control-flow primitive (completion handler/DMA setup) suitable for hijack, so integrity impact is High.\nA:H - The UAF oopses the kernel (KASAN slab-use-after-free in bcd2000_midi_send and usb_submit_urb). The attacker can repeat connect/disconnect to crash on demand, so availability impact is High."
    }
  }
}