{"id":"CVE-2026-80816","state":"PUBLISHED","title":"ALSA: FCP: Use a private URB for the notification endpoint","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: FCP: Use a private URB for the notification endpoint\n\nfcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()\nallocates for the optional UAC2 status interrupt endpoint and mixer.c\nkills, resubmits and frees. On a device with that endpoint,\nfcp_init_notify()'s \"already set up\" early return fires on the status\nURB and returns success without doing anything. No FCP notification\nURB is submitted, and cmd_done is left zeroed because it is\ninitialised past that early return and nowhere else. fcp_init() then\nissues init1_opcode and wait_for_completion_timeout() would crash\nadding to the zeroed wait.head. fcp_cleanup_urb() would also kill and\nfree mixer.c's status URB.\n\nUse a separate URB in fcp_data, and initialise cmd_done in\nfcp_init_private() where fcp_data is allocated. fcp_init_notify() is\nreached again after suspend via fcp_reinit(), and the URB kill path in\nfcp_notify() completes cmd_done, leaving a stale count that would\nsatisfy the next command's wait before the device ACKs. Use\nreinit_completion() to clear it.","publishedAt":"2026-09-04T15:13:37.310Z","updatedAt":"2026-10-19T08:44:09.982Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","status":"affected","lessThan":"65aceb45ca91ddb7f7ed178821f481b34da35543","versionType":"git"},{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","status":"affected","lessThan":"5da21a434171e8ecf1d992c6f1d84c0c706fd395","versionType":"git"},{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","status":"affected","lessThan":"6db3c1d7e2872c9904e05ca8e0515920776a3c9c","versionType":"git"},{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","status":"affected","lessThan":"918b8d231c571c50a00efe92ffc8404a537a0490","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/fcp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"6.18.47","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.11","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2.1","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/fcp.c"]}],"references":["https://git.kernel.org/stable/c/65aceb45ca91ddb7f7ed178821f481b34da35543","https://git.kernel.org/stable/c/5da21a434171e8ecf1d992c6f1d84c0c706fd395","https://git.kernel.org/stable/c/6db3c1d7e2872c9904e05ca8e0515920776a3c9c","https://git.kernel.org/stable/c/918b8d231c571c50a00efe92ffc8404a537a0490"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80816.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80816","state":"PUBLISHED","datePublished":"2026-09-04T15:13:37.310Z","dateUpdated":"2026-10-19T08:44:09.982Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.794Z"},"containers":{"cna":{"title":"ALSA: FCP: Use a private URB for the notification endpoint","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: FCP: Use a private URB for the notification endpoint\n\nfcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()\nallocates for the optional UAC2 status interrupt endpoint and mixer.c\nkills, resubmits and frees. On a device with that endpoint,\nfcp_init_notify()'s \"already set up\" early return fires on the status\nURB and returns success without doing anything. No FCP notification\nURB is submitted, and cmd_done is left zeroed because it is\ninitialised past that early return and nowhere else. fcp_init() then\nissues init1_opcode and wait_for_completion_timeout() would crash\nadding to the zeroed wait.head. fcp_cleanup_urb() would also kill and\nfree mixer.c's status URB.\n\nUse a separate URB in fcp_data, and initialise cmd_done in\nfcp_init_private() where fcp_data is allocated. fcp_init_notify() is\nreached again after suspend via fcp_reinit(), and the URB kill path in\nfcp_notify() completes cmd_done, leaving a stale count that would\nsatisfy the next command's wait before the device ACKs. Use\nreinit_completion() to clear it."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","status":"affected","lessThan":"65aceb45ca91ddb7f7ed178821f481b34da35543","versionType":"git"},{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","status":"affected","lessThan":"5da21a434171e8ecf1d992c6f1d84c0c706fd395","versionType":"git"},{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","status":"affected","lessThan":"6db3c1d7e2872c9904e05ca8e0515920776a3c9c","versionType":"git"},{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","status":"affected","lessThan":"918b8d231c571c50a00efe92ffc8404a537a0490","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/fcp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.14","versionType":"semver"},{"version":"6.18.47","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.11","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2.1","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/fcp.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/65aceb45ca91ddb7f7ed178821f481b34da35543"},{"url":"https://git.kernel.org/stable/c/5da21a434171e8ecf1d992c6f1d84c0c706fd395"},{"url":"https://git.kernel.org/stable/c/6db3c1d7e2872c9904e05ca8e0515920776a3c9c"},{"url":"https://git.kernel.org/stable/c/918b8d231c571c50a00efe92ffc8404a537a0490"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T08:44:09.982Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.47"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.1.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.2.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}