SUSE CVE-2026-80971

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000freeusbrelatedresources frees both URBs and leaves the pointers behind: usbkillurbbcd2k-midiouturb; usbkillurbbcd2k-midiinurb; usbfreeurbbcd2k-midiouturb;...

PT-2026-93674

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the snd usbmidi us122l output function. The issue occurs when the function selects a count of 2 for devices slower than high speed without verifying it...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fixed race conditions related to access to midibuf. There can be concurrent accesses to line6’s midibuf from both the URB completion callback and the rawmidi API. This could trigger a KMSAN warning triggered by...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work when closing a MIDI substream When closing a USB MIDI output substream, there may still be pending work. This work would eventually access the rawmidi runtime object that is being released. To...

DEBIAN-CVE-2026-80973

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

CVE-2026-80971

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000freeusbrelatedresources frees both URBs and leaves the pointers behind: usbkillurbbcd2k-midiouturb; usbkillurbbcd2k-midiinurb; usbfreeurbbcd2k-midiouturb;...

CVE-2026-80973

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

PT-2026-96475

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000 free usb related resources frees both URBs and leaves the pointers behind: usb kill urbbcd2k-midi out urb; usb kill urbbcd2k-midi in urb; usb free urbbcd2k-midi out urb;...

CVE-2026-80971: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000freeusbrelatedresources frees both URBs and leaves the pointers behind: usbkillurbbcd2k-midiouturb; usbkillurbbcd2k-midiinurb; usbfreeurbbcd2k-midiouturb;...

PT-2026-90103

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5 Description An issue exists in the ALSA 6fire driver where the usb6fire comm receiver handler function forwards MIDI events using a length byte provided by the device without proper bounds checking. The...

AZL-99621 CVE-2026-80829 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidinovationoutput sndusbmidinovationoutput lays out a two-byte header at transferbuffer0..1 and passes &transferbuffer2 together with a length of ep-maxtransfer - 2 to sndrawmiditransmit:...

PT-2026-85707

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd usbmidi novation output snd usbmidi novation output lays out a two-byte header at transfer buffer0..1 and passes &transfer buffer2 together with a length of ep-max transfer - 2 to snd rawmidi...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: Fix for double-free of outcvts due to rawmidi errors The sndumpattachlegacyrawmidi function allocates the legacy conversion array ump-outcvts. In the event of an error with sndrawmidinew, this array is freed using kfre...

SUSE CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

UBUNTU-CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

CVE-2026-74502 ALSA: ump: fix double free of out_cvts on rawmidi error

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...

CVE-2026-74502

The CVE-2026-74502 issue affects the Linux kernel ALSA subsystem (ump) where snd_ump_attach_legacy_rawmidi() allocates ump->out_cvts and frees it on error via kfree(), leaving a stale pointer. If the endpoint is torn down later, snd_ump_endpoint_free() frees ump->out_cvts a second time, cau...

CVE-2026-74502

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of outcvts on rawmidi error sndumpattachlegacyrawmidi allocates the legacy conversion array ump-outcvts and, on the sndrawmidinew error path, frees it with kfree but leaves ump-outcvts pointing at the...