Cloudanix VulnDB

CVE-2026-98316

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing problem in a USB music device driver could let the system crash when the device is unplugged while music software is running.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in ALSA bcd2000 USB MIDI driver allows in-flight rawmidi operations (such as bcd2000_midi_send) to access a URB after USB disconnect has begun, resulting in use-after-free.

Why it matters to the business

Systems using the affected USB audio/MIDI device may experience kernel instability or crashes during hot-unplug events; low exploitability and absence from known campaigns limit immediate operational risk.

How an attack unfolds

An attacker with local access to a system using the bcd2000 device triggers concurrent rawmidi activity and USB disconnect; the missing lock allows the operation to dereference a freed URB.

How to fix it

Apply the upstream kernel patch that adds the spinlock protecting rawmidi operations and URB clearance; rebuild and deploy the updated kernel on affected systems.

How to confirm the fix worked

Confirm the spinlock and URB NULL-check under lock are present in the bcd2000 driver source after the patch; test concurrent rawmidi and disconnect scenarios on hardware.

Typical attack path

  1. Attach bcd2000 USB device and start rawmidi activity
  2. Trigger USB disconnect while rawmidi callback is executing
  3. Trigger use of the in-flight URB after it has been freed by disconnect handling

How to detect it

Review kernel logs for USB disconnect events coinciding with ALSA/bcd2000 rawmidi activity; look for use-after-free or URB-related oops around driver unload.

What your security team should do

  • Prioritize kernel updates on systems that use the bcd2000 driver
  • Monitor upstream stable kernel releases for the fix
  • Limit physical USB access on high-value systems until patched

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been already running at USB disconnect handling, the in-flight function (e.g. bcd2000_midi_send()) could still access the URB, because the previous URB NULL-check & clearance was considered only for the URB complete callbacks, but not about the parallel rawmidi operations. For addressing the race, this patch introduced a new spinlock that covers each rawmidi operation as well as the rawmidi handling in the complete callback. The URB is cleared with the lock, so it guarantees that the pending rawmidi task already finished or a NULL check is effective.

Affected packages

Ecosystem Package Introduced Fixed