CVE-2026-80815

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: scarlett2: Use a private URB for the notification endpoint

scarlett2_init_notify() used mixer->urb, which

snd_usb_mixer_status_create() allocates for the UAC2 status interrupt

endpoint and mixer.c manages. On a device with that endpoint, the

"already in use" check fires on the status URB and returns 0 for

success without doing anything. No notification URB is submitted, and

cmd_done is left zeroed because it is initialised past that check and

nowhere else. scarlett2_usb_init() then issues SCARLETT2_USB_INIT_1

and wait_for_completion_timeout() would crash adding to the zeroed

wait.head.

Use a separate URB in scarlett2_data, as done for FCP, and initialise

cmd_done in scarlett2_init_private(). mixer.c was also freeing the URB

in snd_usb_mixer_free() and resubmitting it in

snd_usb_mixer_activate(), so scarlett2 must now do both: add

scarlett2_cleanup_urb(), called from private_free and private_suspend,

and a priv

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References