CVE-2026-98316

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: bcd2000: Fix race between rawmidi and disconnect

Although we tried to fix the potential UAF issues at USB disconnect on

bcd2000 driver, there is still an overlooked case -- namely, when a

rawmidi trigger callback has been already running at USB disconnect

handling, the in-flight function (e.g. bcd2000_midi_send()) could

still access the URB, because the previous URB NULL-check & clearance

was considered only for the URB complete callbacks, but not about the

parallel rawmidi operations.

For addressing the race, this patch introduced a new spinlock that

covers each rawmidi operation as well as the rawmidi handling in the

complete callback. The URB is cleared with the lock, so it guarantees

that the pending rawmidi task already finished or a NULL check is

effective.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References