CVE-2026-80971
nicheUse-After-Free in Linux Kernel ALSA BCD2000 USB MIDI Driver on Disconnect
A use-after-free exists in the Linux kernel's ALSA snd_bcd2000 driver for the Behringer BCD2000 USB audio/MIDI controller. When the device is unplugged, bcd2000_free_usb_related_resources() frees the driver's two URBs but leaves the pointers dangling, so a rawmidi substream that is still open can later reach bcd2000_midi_send() and write to the freed URB memory and resubmit it to the USB core (confirmed by a KASAN slab-use-after-free report). A local attacker with low privileges who can open the MIDI device and race a disconnect could exploit this for kernel memory corruption, with impact rated high for confidentiality, integrity, and availability (CVSS 3.1: 7.8), including potential privilege escalation or a kernel crash. Only systems with the snd_bcd2000 driver in use (i.e., a Behringer BCD2000 attached to a Linux machine) are exposed. No public proof of concept is known and there is no evidence of exploitation in the wild.
What to do: Update to a kernel release containing the fix, which uses usb_poison_urb() before freeing the URBs and clears the midi_in_urb/midi_out_urb pointers, with NULL checks on the trigger and completion paths. If patching is delayed, blacklist the snd_bcd2000 module on machines that don't need it and restrict local access to the BCD2000 rawmidi device node. Verify whether the module is loaded (lsmod | grep snd_bcd2000) on audio workstations that connect this hardware.
| Linux kernel (ALSA snd_bcd2000 driver) | Confirmed present on 7.2.0-rc5; affects kernel versions prior to the fix that clears the URB pointers and poisons the URBs on disconnect (specific fixed release |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000_free_usb_related_resources() frees both URBs and leaves the pointers behind: usb_kill_urb(bcd2k->midi_out_urb); usb_kill_urb(bcd2k->midi_in_urb); usb_free_urb(bcd2k->midi_out_urb); usb_free_urb(bcd2k->midi_in_urb); The rawmidi device outlives that call. A substream that is still open when the device is unplugged reaches bcd2000_midi_send() from the trigger path on close. That function writes to the freed URB and then hands it to the USB core: bcd2k->midi_out_urb->transfer_buffer_length = BUFSIZE; ... ret = usb_submit_urb(bcd2k->midi_out_urb, GFP_ATOMIC); usb_kill_urb() does not stop a later submission either, so a submit that races the disconnect can requeue the URB after it has been reaped. midi_in_urb is exposed the same way: bcd2000_input_complete() resubmits it from the completion handler. KASAN on 7.2.0-rc5 (arm64): BUG: KASAN: slab-use-after-free in bcd2000_midi_send [snd_bcd2000] Write of size 4 at addr ffff00001827d388 by task bpoc/168 __asan_store4 bcd2000_midi_send [snd_bcd2000] bcd2000_midi_output_trigger [snd_bcd2000] snd_rawmidi_kernel_write1 close_substream.part.0 Freed by task 168: usb_free_urb bcd2000_disconnect [snd_bcd2000] BUG: KASAN: slab-use-after-free in usb_submit_urb Read of size 8 at addr ffff00001827d3b8 by task bpoc/168 Clear both pointers after freeing and test them on the paths that can still run. Poison the URBs before freeing them: usb_poison_urb() waits for a running completion handler and rejects any later submission, so after it returns the input path is quiesced and only the rawmidi trigger path can still reach bcd2000_midi_send(). No unpoison is needed; the URBs are freed on the next line. Discovered by XBOW, triaged by Baul Lee
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.