{"id":"CVE-2026-80816","revision":"2a7bd50b318b475bb0b367864fc6bd42","records":[{"revision":"2a7bd50b318b475bb0b367864fc6bd42","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80816","aliases":[],"title":"ALSA: FCP: Use a private URB for the notification endpoint","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: FCP: Use a private URB for the notification endpoint\n\nfcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()\nallocates for the optional UAC2 status interrupt endpoint and mixer.c\nkills, resubmits and frees. On a device with that endpoint,\nfcp_init_notify()'s \"already set up\" early return fires on the status\nURB and returns success without doing anything. No FCP notification\nURB is submitted, and cmd_done is left zeroed because it is\ninitialised past that early return and nowhere else. fcp_init() then\nissues init1_opcode and wait_for_completion_timeout() would crash\nadding to the zeroed wait.head. fcp_cleanup_urb() would also kill and\nfree mixer.c's status URB.\n\nUse a separate URB in fcp_data, and initialise cmd_done in\nfcp_init_private() where fcp_data is allocated. fcp_init_notify() is\nreached again after suspend via fcp_reinit(), and the URB kill path in\nfcp_notify() completes cmd_done, leaving a stale count that would\nsatisfy the next command's wait before the device ACKs. Use\nreinit_completion() to clear it.","state":0,"publishedAt":"2026-09-04T15:13:37.31+00:00","modifiedAt":"2026-10-19T08:44:09.982+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/usb/fcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"46757a3e7d50dac923888e7fbe68377736f13c70\",\n                            \"lessThan\": \"65aceb45ca91ddb7f7ed178821f481b34da35543\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"46757a3e7d50dac923888e7fbe68377736f13c70\",\n                            \"lessThan\": \"5da21a434171e8ecf1d992c6f1d84c0c706fd395\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"46757a3e7d50dac923888e7fbe68377736f13c70\",\n                            \"lessThan\": \"6db3c1d7e2872c9904e05ca8e0515920776a3c9c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"46757a3e7d50dac923888e7fbe68377736f13c70\",\n                            \"lessThan\": \"918b8d231c571c50a00efe92ffc8404a537a0490\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/usb/fcp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.47\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.11\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.1\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/65aceb45ca91ddb7f7ed178821f481b34da35543","https://git.kernel.org/stable/c/5da21a434171e8ecf1d992c6f1d84c0c706fd395","https://git.kernel.org/stable/c/6db3c1d7e2872c9904e05ca8e0515920776a3c9c","https://git.kernel.org/stable/c/918b8d231c571c50a00efe92ffc8404a537a0490"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80816","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80816","identifiers":["CVE-2026-80816"]},"retained":false,"historicalAffected":[]}],"coverage":[]}