CVE-2026-80971

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ALSA: bcd2000: clear the URB pointers on disconnect

bcd2000_free_usb_related_resources() frees both URBs and leaves the pointers behind:

The rawmidi device outlives that call. A substream that is still open when the device is unplugged reaches bcd2000_midi_send() from the trigger path on close. That function writes to the freed URB and then hands it to the USB core:

usb_kill_urb() does not stop a later submission either, so a submit that races the disconnect can requeue the URB after it has been reaped. midi_in_urb is exposed the same way: bcd2000_input_complete() resubmits it from the completion handler.

Leer descripción completaMostrar menos

Clear both pointers after freeing and test them on the paths that can still run. Poison the URBs before freeing them: usb_poison_urb() waits for a running completion handler and rejects any later submission, so after it returns the input path is quiesced and only the rawmidi trigger path can still reach bcd2000_midi_send(). No unpoison is needed; the URBs are freed on the next line.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Detalles técnicos trazas, registros y código del informe original

	usb_kill_urb(bcd2k->midi_out_urb);
	usb_kill_urb(bcd2k->midi_in_urb);

	usb_free_urb(bcd2k->midi_out_urb);
	usb_free_urb(bcd2k->midi_in_urb);

	bcd2k->midi_out_urb->transfer_buffer_length = BUFSIZE;
	...
	ret = usb_submit_urb(bcd2k->midi_out_urb, GFP_ATOMIC);

KASAN on 7.2.0-rc5 (arm64):

  BUG: KASAN: slab-use-after-free in bcd2000_midi_send [snd_bcd2000]
  Write of size 4 at addr ffff00001827d388 by task bpoc/168
   __asan_store4
   bcd2000_midi_send [snd_bcd2000]
   bcd2000_midi_output_trigger [snd_bcd2000]
   snd_rawmidi_kernel_write1
   close_substream.part.0
  Freed by task 168:
   usb_free_urb
   bcd2000_disconnect [snd_bcd2000]

  BUG: KASAN: slab-use-after-free in usb_submit_urb
  Read of size 8 at addr ffff00001827d3b8 by task bpoc/168

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.16%
Percentil entre todas las CVEs puntuadas: 5
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation75 %
Impacto principalT1059 Command and Scripting Interpreterexecution65 %

Vulnerabilidad de use-after-free en kernel Linux (AV:L, PR:L) que permite ejecución de código local al escribir en memoria liberada mediante URB de ALSA tras desconexión de dispositivo USB.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution Prevention Threat Intelligence Program Restrict Web-Based Content Privileged Account Management Limit Software Installation Behavior Prevention on Endpoint

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-80971",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b47a22290d581277be70e8a597824a4985d39e83",
              "lessThan": "9af08677aa57debaca5b57c8045c52a83d3dd376",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b47a22290d581277be70e8a597824a4985d39e83",
              "lessThan": "5a77febac6faf6da40fbb4555f703eeb91b58130",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b47a22290d581277be70e8a597824a4985d39e83",
              "lessThan": "3c00004f134fc819f9d9e202c6a64acde0a1f8d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b47a22290d581277be70e8a597824a4985d39e83",
              "lessThan": "6c07aad8a7c9ef8ebc4d03a964b882123a349a2e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b47a22290d581277be70e8a597824a4985d39e83",
              "lessThan": "eb482a06791d6168beb8c78cc904ac5a5ed96a55",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b47a22290d581277be70e8a597824a4985d39e83",
              "lessThan": "7df3194bdb7479cad9199889655a566a2c0c1d1b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b47a22290d581277be70e8a597824a4985d39e83",
              "lessThan": "b06ebc7fe25a6af4a9f6e4a3d4236a4178ad4b01",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b47a22290d581277be70e8a597824a4985d39e83",
              "lessThan": "459d3a64766f5ca2f1886daeaf24582831a5f5ab",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "sound/usb/bcd2000/bcd2000.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "sound/usb/bcd2000/bcd2000.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:03.233",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3c00004f134fc819f9d9e202c6a64acde0a1f8d0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/459d3a64766f5ca2f1886daeaf24582831a5f5ab",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5a77febac6faf6da40fbb4555f703eeb91b58130",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6c07aad8a7c9ef8ebc4d03a964b882123a349a2e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7df3194bdb7479cad9199889655a566a2c0c1d1b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9af08677aa57debaca5b57c8045c52a83d3dd376",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b06ebc7fe25a6af4a9f6e4a3d4236a4178ad4b01",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eb482a06791d6168beb8c78cc904ac5a5ed96a55",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: bcd2000: clear the URB pointers on disconnect\n\nbcd2000_free_usb_related_resources() frees both URBs and leaves the\npointers behind:\n\n\tusb_kill_urb(bcd2k->midi_out_urb);\n\tusb_kill_urb(bcd2k->midi_in_urb);\n\n\tusb_free_urb(bcd2k->midi_out_urb);\n\tusb_free_urb(bcd2k->midi_in_urb);\n\nThe rawmidi device outlives that call.  A substream that is still open\nwhen the device is unplugged reaches bcd2000_midi_send() from the\ntrigger path on close.  That function writes to the freed URB and then\nhands it to the USB core:\n\n\tbcd2k->midi_out_urb->transfer_buffer_length = BUFSIZE;\n\t...\n\tret = usb_submit_urb(bcd2k->midi_out_urb, GFP_ATOMIC);\n\nusb_kill_urb() does not stop a later submission either, so a submit that\nraces the disconnect can requeue the URB after it has been reaped.\nmidi_in_urb is exposed the same way: bcd2000_input_complete() resubmits\nit from the completion handler.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n  BUG: KASAN: slab-use-after-free in bcd2000_midi_send [snd_bcd2000]\n  Write of size 4 at addr ffff00001827d388 by task bpoc/168\n   __asan_store4\n   bcd2000_midi_send [snd_bcd2000]\n   bcd2000_midi_output_trigger [snd_bcd2000]\n   snd_rawmidi_kernel_write1\n   close_substream.part.0\n  Freed by task 168:\n   usb_free_urb\n   bcd2000_disconnect [snd_bcd2000]\n\n  BUG: KASAN: slab-use-after-free in usb_submit_urb\n  Read of size 8 at addr ffff00001827d3b8 by task bpoc/168\n\nClear both pointers after freeing and test them on the paths that can\nstill run.  Poison the URBs before freeing them: usb_poison_urb() waits\nfor a running completion handler and rejects any later submission, so\nafter it returns the input path is quiesced and only the rawmidi trigger\npath can still reach bcd2000_midi_send().  No unpoison is needed; the\nURBs are freed on the next line.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"
    }
  ],
  "lastModified": "2026-09-14T13:18:51.890",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}