CVE-2026-72443 - Vulnerability Details

- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints

MIDI 2.0 input URBs are started during snd_usb_midi_v2_create(). A
later setup failure can still jump to snd_usb_midi_v2_free(), which
currently frees each endpoint and its coherent URB buffers without first
stopping the submitted URBs. A completion can then dereference the
embedded URB context and endpoint state after they have been freed, or
try to resubmit from the stale endpoint.

This was observed as a KASAN slab-use-after-free in
input_urb_complete().

The buggy scenario involves two paths, with each column showing the order
within that path:

probe error path: USB completion path:
1. start_input_streams() submits 1. The HCD still owns a
input URBs. submitted input URB.
2. A later setup helper returns 2. input_urb_complete() runs
an error. with urb->context in ep.
3. snd_usb_midi_v2_free() frees 3. The completion reads ep
endpoint storage and URB buffers. state and can requeue URBs.

Make the endpoint destructor follow the same teardown ordering used for
disconnect when the endpoint has not already been disconnected: publish
ep->disconnected, kill the URBs synchronously, and drain the endpoint
before freeing URB buffers and endpoint storage. The guard avoids
repeating the stop sequence after the normal
snd_usb_midi_v2_disconnect_all() path, while still synchronizing the
direct MIDI 2.0 create-error free path.

Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in input_urb_complete+0x37/0x1b0
Workqueue: usb_hub_wq hub_event
RIP: 0010:_raw_spin_unlock_irq+0x2e/0x50
Read of size 8
Call trace:
dump_stack_lvl+0x77/0xb0
print_report+0xce/0x5f0
input_urb_complete+0x37/0x1b0 (sound/usb/midi2.c:186)
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x19f/0x330
kasan_report+0xe0/0x110
__usb_hcd_giveback_urb+0x112/0x1d0
dummy_timer+0xaaa/0x19a0
lock_is_held_type+0x9a/0x110
__lock_acquire+0x467/0x28b0
mark_held_locks+0x40/0x70
_raw_spin_unlock_irqrestore+0x44/0x60
lockdep_hardirqs_on_prepare+0xbb/0x1a0
__hrtimer_run_queues+0x101/0x520
hrtimer_run_softirq+0xd0/0x130
handle_softirqs+0x15b/0x670
__irq_exit_rcu+0xd0/0x170
irq_exit_rcu+0xe/0x20
sysvec_apic_timer_interrupt+0x6c/0x80
asm_sysvec_apic_timer_interrupt+0x1a/0x20

Published: 2026-08-15

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ALSA USB audio driver contains a race condition in the MIDI 2.0 input path. When a stream is created, URBs are submitted; if device setup later fails, the driver frees the endpoint memory but does not stop those URBs. The completion handler then dereferences freed data, causing a slab‑use‑after‑free. This flaw results in kernel memory corruption when the snd_usb driver processes a USB MIDI device that fails during initialization. The weakness is a use‑after‑free and involves improperly synchronized buffer deallocation (CWE‑825).

Affected Systems

The vulnerability exists in the Linux kernel ALSA subsystem for all builds that include the usb‑audio module. Vendor: Linux; Product: Linux kernel. Specific kernel versions are not listed, but the fix is available in later releases and by applying the upstream commit 3d961032a6e58fa485b3a4c0fe0f649334d887de. Any system running an unpatched kernel that loads the snd_usb driver and connects a USB MIDI device is potentially affected.

Risk and Exploitability

The CVSS score of 7.0 indicates high severity, while the EPSS score of <1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The flaw would be triggered during normal audio operations when a USB MIDI device is connected and the driver attempts to initialize it. Because the bug involves kernel memory corruption, any exploitation would occur at kernel level. The attack vector, as described by the bug, requires the device to be processed by the ALSA driver, which typically happens when the drivers are loaded and a USB MIDI device is present.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d9c99876868c861afd0e9ce2cea407bbc446b3c9`	affected	< bcdd5a7363bdd287253c406a9c0205f5722058e7
`d9c99876868c861afd0e9ce2cea407bbc446b3c9`	affected	< 3d961032a6e58fa485b3a4c0fe0f649334d887de
`d9c99876868c861afd0e9ce2cea407bbc446b3c9`	affected	< 4c16176fc11a61b7545464cb47c98b0c8a055fcb
`d9c99876868c861afd0e9ce2cea407bbc446b3c9`	affected	< 68286258698e15fe75073fb8d017003f8e493db1
`d9c99876868c861afd0e9ce2cea407bbc446b3c9`	affected	< f199c8a8bdd54296d3458777e70fe82a78bd9817

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d9c99876868c861afd0e9ce2cea407bbc446b3c9,bcdd5a7363bdd287253c406a9c0205f5722058e7)`	affected	code_commit	—
`[d9c99876868c861afd0e9ce2cea407bbc446b3c9,3d961032a6e58fa485b3a4c0fe0f649334d887de)`	affected	code_commit	—
`[d9c99876868c861afd0e9ce2cea407bbc446b3c9,4c16176fc11a61b7545464cb47c98b0c8a055fcb)`	affected	code_commit	—
`[d9c99876868c861afd0e9ce2cea407bbc446b3c9,68286258698e15fe75073fb8d017003f8e493db1)`	affected	code_commit	—
`[d9c99876868c861afd0e9ce2cea407bbc446b3c9,f199c8a8bdd54296d3458777e70fe82a78bd9817)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.5`	affected	generic	—
`[0,6.5)`	unaffected	generic	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a release that contains the ALSA USB audio fix (commit 3d961032a6e58fa485b3a4c0fe0f649334d887de).
Unload or blacklist the snd_usb module until the kernel can be updated, e.g., echo "blacklist snd_usb" > /etc/modprobe.d/disable-snd_usb.conf and reboot or run rmmod snd_usb.
Apply a udev rule to restrict USB audio device usage, or disable USB audio devices in the BIOS to prevent the failing probe path from executing.
If system uptime is critical and the driver must remain, isolate the hardware by ensuring no device causing the failure is connected; consider using a local script to stop the ALSA USB audio subsystem before configuration changes.

Generated by OpenCVE AI on August 22, 2026 at 06:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3d961032a6e58fa485b3a4c0fe0f649334d887de
https://git.kernel.org/stable/c/4c16176fc11a61b7545464cb47c98b0c8a055fcb
https://git.kernel.org/stable/c/68286258698e15fe75073fb8d017003f8e493db1
https://git.kernel.org/stable/c/bcdd5a7363bdd287253c406a9c0205f5722058e7
https://git.kernel.org/stable/c/f199c8a8bdd54296d3458777e70fe82a78bd9817
https://lore.kernel.org/linux-cve-announce/2026081529-CVE-2026-72443-5a15@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72443
https://www.cve.org/CVERecord?id=CVE-2026-72443

History

Sat, 22 Aug 2026 05:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Thu, 20 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081529-CVE-2026-72443-5a15@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72443 https://www.cve.org/CVERecord?id=CVE-2026-72443
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are started during snd_usb_midi_v2_create(). A later setup failure can still jump to snd_usb_midi_v2_free(), which currently frees each endpoint and its coherent URB buffers without first stopping the submitted URBs. A completion can then dereference the embedded URB context and endpoint state after they have been freed, or try to resubmit from the stale endpoint. This was observed as a KASAN slab-use-after-free in input_urb_complete(). The buggy scenario involves two paths, with each column showing the order within that path: probe error path: USB completion path: 1. start_input_streams() submits 1. The HCD still owns a input URBs. submitted input URB. 2. A later setup helper returns 2. input_urb_complete() runs an error. with urb->context in ep. 3. snd_usb_midi_v2_free() frees 3. The completion reads ep endpoint storage and URB buffers. state and can requeue URBs. Make the endpoint destructor follow the same teardown ordering used for disconnect when the endpoint has not already been disconnected: publish ep->disconnected, kill the URBs synchronously, and drain the endpoint before freeing URB buffers and endpoint storage. The guard avoids repeating the stop sequence after the normal snd_usb_midi_v2_disconnect_all() path, while still synchronizing the direct MIDI 2.0 create-error free path. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in input_urb_complete+0x37/0x1b0 Workqueue: usb_hub_wq hub_event RIP: 0010:_raw_spin_unlock_irq+0x2e/0x50 Read of size 8 Call trace: dump_stack_lvl+0x77/0xb0 print_report+0xce/0x5f0 input_urb_complete+0x37/0x1b0 (sound/usb/midi2.c:186) srso_alias_return_thunk+0x5/0xfbef5 __virt_addr_valid+0x19f/0x330 kasan_report+0xe0/0x110 __usb_hcd_giveback_urb+0x112/0x1d0 dummy_timer+0xaaa/0x19a0 lock_is_held_type+0x9a/0x110 __lock_acquire+0x467/0x28b0 mark_held_locks+0x40/0x70 _raw_spin_unlock_irqrestore+0x44/0x60 lockdep_hardirqs_on_prepare+0xbb/0x1a0 __hrtimer_run_queues+0x101/0x520 hrtimer_run_softirq+0xd0/0x130 handle_softirqs+0x15b/0x670 __irq_exit_rcu+0xd0/0x170 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x6c/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20
Title		ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3d961032a6e58fa485b3a4c0fe0f649334d887de https://git.kernel.org/stable/c/4c16176fc11a61b7545464cb47c98b0c8a055fcb https://git.kernel.org/stable/c/68286258698e15fe75073fb8d017003f8e493db1 https://git.kernel.org/stable/c/bcdd5a7363bdd287253c406a9c0205f5722058e7 https://git.kernel.org/stable/c/f199c8a8bdd54296d3458777e70fe82a78bd9817

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:56:54.601Z

Updated: 2026-08-17T05:14:44.380Z

Reserved: 2026-08-09T03:40:39.930Z

Link: CVE-2026-72443

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:18.160

Modified: 2026-08-17T06:19:11.710

Link: CVE-2026-72443

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72443 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T06:45:04Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object