ZeroHour

CVE-2026-80971

niche

Use-After-Free in Linux Kernel ALSA BCD2000 USB MIDI Driver on Disconnect

CVSS 3.1
7.8 high
EPSS
Published
()
Modified
AI analysis

A use-after-free exists in the Linux kernel's ALSA snd_bcd2000 driver for the Behringer BCD2000 USB audio/MIDI controller. When the device is unplugged, bcd2000_free_usb_related_resources() frees the driver's two URBs but leaves the pointers dangling, so a rawmidi substream that is still open can later reach bcd2000_midi_send() and write to the freed URB memory and resubmit it to the USB core (confirmed by a KASAN slab-use-after-free report). A local attacker with low privileges who can open the MIDI device and race a disconnect could exploit this for kernel memory corruption, with impact rated high for confidentiality, integrity, and availability (CVSS 3.1: 7.8), including potential privilege escalation or a kernel crash. Only systems with the snd_bcd2000 driver in use (i.e., a Behringer BCD2000 attached to a Linux machine) are exposed. No public proof of concept is known and there is no evidence of exploitation in the wild.

What to do: Update to a kernel release containing the fix, which uses usb_poison_urb() before freeing the URBs and clears the midi_in_urb/midi_out_urb pointers, with NULL checks on the trigger and completion paths. If patching is delayed, blacklist the snd_bcd2000 module on machines that don't need it and restrict local access to the BCD2000 rawmidi device node. Verify whether the module is loaded (lsmod | grep snd_bcd2000) on audio workstations that connect this hardware.

Affected
Linux kernel (ALSA snd_bcd2000 driver)Confirmed present on 7.2.0-rc5; affects kernel versions prior to the fix that clears the URB pointers and poisons the URBs on disconnect (specific fixed release
Estimated exposure
nichelikely at most low thousands of systems worldwide — The snd_bcd2000 module only binds when a Behringer BCD2000 DJ controller is plugged in, a niche legacy USB device, so exposure is limited to Linux systems with that specific hardware attached.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000_free_usb_related_resources() frees both URBs and leaves the pointers behind: usb_kill_urb(bcd2k->midi_out_urb); usb_kill_urb(bcd2k->midi_in_urb); usb_free_urb(bcd2k->midi_out_urb); usb_free_urb(bcd2k->midi_in_urb); The rawmidi device outlives that call. A substream that is still open when the device is unplugged reaches bcd2000_midi_send() from the trigger path on close. That function writes to the freed URB and then hands it to the USB core: bcd2k->midi_out_urb->transfer_buffer_length = BUFSIZE; ... ret = usb_submit_urb(bcd2k->midi_out_urb, GFP_ATOMIC); usb_kill_urb() does not stop a later submission either, so a submit that races the disconnect can requeue the URB after it has been reaped. midi_in_urb is exposed the same way: bcd2000_input_complete() resubmits it from the completion handler. KASAN on 7.2.0-rc5 (arm64): BUG: KASAN: slab-use-after-free in bcd2000_midi_send [snd_bcd2000] Write of size 4 at addr ffff00001827d388 by task bpoc/168 __asan_store4 bcd2000_midi_send [snd_bcd2000] bcd2000_midi_output_trigger [snd_bcd2000] snd_rawmidi_kernel_write1 close_substream.part.0 Freed by task 168: usb_free_urb bcd2000_disconnect [snd_bcd2000] BUG: KASAN: slab-use-after-free in usb_submit_urb Read of size 8 at addr ffff00001827d3b8 by task bpoc/168 Clear both pointers after freeing and test them on the paths that can still run. Poison the URBs before freeing them: usb_poison_urb() waits for a running completion handler and rejects any later submission, so after it returns the input path is quiesced and only the rawmidi trigger path can still reach bcd2000_midi_send(). No unpoison is needed; the URBs are freed on the next line. Discovered by XBOW, triaged by Baul Lee

Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the news

No ingested article mentions this CVE yet.