CVE-2026-80816

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: FCP: Use a private URB for the notification endpoint

fcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()

allocates for the optional UAC2 status interrupt endpoint and mixer.c

kills, resubmits and frees. On a device with that endpoint,

fcp_init_notify()'s "already set up" early return fires on the status

URB and returns success without doing anything. No FCP notification

URB is submitted, and cmd_done is left zeroed because it is

initialised past that early return and nowhere else. fcp_init() then

issues init1_opcode and wait_for_completion_timeout() would crash

adding to the zeroed wait.head. fcp_cleanup_urb() would also kill and

free mixer.c's status URB.

Use a separate URB in fcp_data, and initialise cmd_done in

fcp_init_private() where fcp_data is allocated. fcp_init_notify() is

reached again after suspend via fcp_reinit(), and the URB kill path in

fcp_notify() completes cmd_done, leaving

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References