CVE-2026-80971

What it actually does

The ALSA bcd2000 USB MIDI driver frees the MIDI in/out URBs on disconnect but leaves dangling pointers. A still-open rawmidi substream can later write URB fields and call usb_submit_urb on freed objects (bcd2000_midi_send / output trigger on close); the input completion handler can resubmit midi_in_urb the same way. usb_kill_urb does not prevent a racing later submit. Result is a kernel slab use-after-free (write and read) against URB objects, enabling memory corruption, kernel crash, or local privilege escalation.

Why it matters to the business

Linux hosts that load this niche Behringer BCD2000 MIDI driver can panic or, in a worst case, be fully taken over by a logged-in low-privilege user. Blast radius is limited to systems with snd_bcd2000; the issue is not in CISA KEV, has no reported ransomware use, exploit maturity is none, and EPSS is very low and flat (~0.0017 over 30 days). It is still a high-severity local kernel memory-corruption bug (CVSS 7.8) published about 20 days ago, so it should be absorbed into normal kernel patching rather than treated as an internet-facing emergency.

How an attack unfolds

A local low-privilege user on a Linux system with snd_bcd2000 loaded opens a MIDI substream, then unplugs or races USB disconnect. Disconnect frees both URBs without clearing pointers. Close or output-trigger still reaches bcd2000_midi_send, which writes the freed URB and may submit it; the input completion path can resubmit midi_in_urb. A submit that races disconnect can requeue an already-reaped URB. The use-after-free against kernel slab objects can crash the host or be abused for local privilege escalation. No public exploit, named threat actor, or in-the-wild use is reported.

How to fix it

Install a distribution or upstream stable Linux kernel that includes the ALSA bcd2000 fix: poison the MIDI URBs with usb_poison_urb, free them, clear midi_out_urb and midi_in_urb, and null-check remaining send/completion paths. No specific package versions were provided with this record, so take the latest kernel update from your vendor that mentions this ALSA bcd2000 disconnect fix. If the hardware is not required, unload and blacklist snd_bcd2000 to remove the attack surface. No unpoison or other runtime workaround is required after the URBs are freed.

How to confirm the fix worked

Confirm the running kernel includes the bcd2000_free_usb_related_resources change (usb_poison_urb, pointer clear, null checks on send/completion). Verify snd_bcd2000 is the patched build or is not loaded (lsmod, module directory under /lib/modules). On a test system with the device, disconnect while a MIDI substream is open and confirm no KASAN slab-use-after-free or oops in bcd2000_midi_send or usb_submit_urb.

Typical attack path

1. Obtain local low-privilege access on a Linux host where snd_bcd2000 is loaded
2. Open a rawmidi substream so the MIDI URBs are allocated and in use
3. Disconnect or unplug the USB device while the substream remains open, freeing URBs but leaving dangling pointers
4. Cause the output trigger/close path or input completion handler to write to or resubmit the freed URB
5. Use the resulting kernel slab use-after-free to crash the kernel or attempt local privilege escalation

How to detect it

No in-the-wild exploitation or named threat actors are associated with this CVE. Hunt kernel logs and crash dumps for KASAN or oops activity in snd_bcd2000 around USB disconnect of a BCD2000-class device: dmesg, journalctl -k, /var/log/kern.log, kdump. Look for slab-use-after-free in bcd2000_midi_send or usb_submit_urb, stacks through bcd2000_midi_output_trigger, close_substream, bcd2000_input_complete, or bcd2000_disconnect, and usb_free_urb from the disconnect path. Coincidence of MIDI unplug and a kernel oops is the main artifact. Lack of KASAN does not prove the bug was not hit.

• KASAN: slab-use-after-free in bcd2000_midi_send
• KASAN: slab-use-after-free in usb_submit_urb
• bcd2000_midi_send [snd_bcd2000]
• bcd2000_midi_output_trigger [snd_bcd2000]
• bcd2000_disconnect [snd_bcd2000]
• bcd2000_input_complete
• snd_bcd2000

What your security team should do

• Patch Linux kernels on a normal high-severity cadence; not KEV, no ransomware use, exploit maturity none, EPSS low and unchanged for 30 days
• Inventory hosts for snd_bcd2000 and Behringer BCD2000 USB devices; unload or blacklist the module where the hardware is unused
• Keep kernel oops, kdump/KASAN, and USB disconnect logging enabled on lab and audio workstations that may attach this device
• Watch for public exploit code; none is known today
• Do not skip kernel updates—CVSS 7.8 local UAF can turn a foothold into root if an exploit appears