Description
In the Linux kernel, the following vulnerability has been resolved:

ALSA: FCP: Use a private URB for the notification endpoint

fcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()
allocates for the optional UAC2 status interrupt endpoint and mixer.c
kills, resubmits and frees. On a device with that endpoint,
fcp_init_notify()'s "already set up" early return fires on the status
URB and returns success without doing anything. No FCP notification
URB is submitted, and cmd_done is left zeroed because it is
initialised past that early return and nowhere else. fcp_init() then
issues init1_opcode and wait_for_completion_timeout() would crash
adding to the zeroed wait.head. fcp_cleanup_urb() would also kill and
free mixer.c's status URB.

Use a separate URB in fcp_data, and initialise cmd_done in
fcp_init_private() where fcp_data is allocated. fcp_init_notify() is
reached again after suspend via fcp_reinit(), and the URB kill path in
fcp_notify() completes cmd_done, leaving a stale count that would
satisfy the next command's wait before the device ACKs. Use
reinit_completion() to clear it.
Published: 2026-09-04
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw arises because ALSA’s FCP notification logic reuses the mixer's URB instead of allocating a private one. When fcp_init_notify() detects an already established URB it skips submitting a notification request, leaving the cmd_done counter uninitialized. Later calls that wait on this counter use the zeroed value, causing a kernel crash. The code also attempts to clear a stale completion flag after device suspension, compounding the instability.

Affected Systems

All Linux kernel deployments that run ALSA on hardware supporting the UAC2 optional status interrupt endpoint are susceptible. Affected devices include any USB audio device that engages the FCP stream. The patch has been incorporated into the stable kernel source but no specific version matrix is provided.

Risk and Exploitability

The kernel panic resulting from this defect could be exploited for denial‑of‑service or, if an attacker gains the ability to coerce the system into initializing FCP (for example via a local USB audio driver), it could lead to privilege escalation. EPSS information is not available, and the issue is not currently listed in the CISA KEV catalog, but the severity of a kernel crash warrants immediate remediation.

Generated by OpenCVE AI on September 4, 2026 at 17:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the kernel to a release that contains the fcp_fix commit (for example, any 6.x kernel downstream of the patch that appears in the stable branch).
  • If a kernel upgrade is not immediately possible, ensure the affected USB audio device is disconnected or the machine is rebooted to clear any pending URBs and prevent repeated crashes until the patch can be applied.
  • Continuously monitor kernel logs (e.g., dmesg or /var/log/kern.log) for "fcp" or ALSA related panic messages; if such log entries appear, isolate the offending device and halt further use until the system is patched.

Generated by OpenCVE AI on September 4, 2026 at 17:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-457
CWE-730

Fri, 04 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB for the notification endpoint fcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create() allocates for the optional UAC2 status interrupt endpoint and mixer.c kills, resubmits and frees. On a device with that endpoint, fcp_init_notify()'s "already set up" early return fires on the status URB and returns success without doing anything. No FCP notification URB is submitted, and cmd_done is left zeroed because it is initialised past that early return and nowhere else. fcp_init() then issues init1_opcode and wait_for_completion_timeout() would crash adding to the zeroed wait.head. fcp_cleanup_urb() would also kill and free mixer.c's status URB. Use a separate URB in fcp_data, and initialise cmd_done in fcp_init_private() where fcp_data is allocated. fcp_init_notify() is reached again after suspend via fcp_reinit(), and the URB kill path in fcp_notify() completes cmd_done, leaving a stale count that would satisfy the next command's wait before the device ACKs. Use reinit_completion() to clear it.
Title ALSA: FCP: Use a private URB for the notification endpoint
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-04T15:13:37.310Z

Reserved: 2026-08-26T14:34:25.794Z

Link: CVE-2026-80816

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T16:18:09.190

Modified: 2026-09-04T16:18:09.190

Link: CVE-2026-80816

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T17:30:17Z

Weaknesses