{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80816","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.794Z","datePublished":"2026-09-04T15:13:37.310Z","dateUpdated":"2026-09-04T15:13:37.310Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-04T15:13:37.310Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: FCP: Use a private URB for the notification endpoint\n\nfcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()\nallocates for the optional UAC2 status interrupt endpoint and mixer.c\nkills, resubmits and frees. On a device with that endpoint,\nfcp_init_notify()'s \"already set up\" early return fires on the status\nURB and returns success without doing anything. No FCP notification\nURB is submitted, and cmd_done is left zeroed because it is\ninitialised past that early return and nowhere else. fcp_init() then\nissues init1_opcode and wait_for_completion_timeout() would crash\nadding to the zeroed wait.head. fcp_cleanup_urb() would also kill and\nfree mixer.c's status URB.\n\nUse a separate URB in fcp_data, and initialise cmd_done in\nfcp_init_private() where fcp_data is allocated. fcp_init_notify() is\nreached again after suspend via fcp_reinit(), and the URB kill path in\nfcp_notify() completes cmd_done, leaving a stale count that would\nsatisfy the next command's wait before the device ACKs. Use\nreinit_completion() to clear it."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/fcp.c"],"versions":[{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","lessThan":"65aceb45ca91ddb7f7ed178821f481b34da35543","status":"affected","versionType":"git"},{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","lessThan":"5da21a434171e8ecf1d992c6f1d84c0c706fd395","status":"affected","versionType":"git"},{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","lessThan":"6db3c1d7e2872c9904e05ca8e0515920776a3c9c","status":"affected","versionType":"git"},{"version":"46757a3e7d50dac923888e7fbe68377736f13c70","lessThan":"918b8d231c571c50a00efe92ffc8404a537a0490","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/usb/fcp.c"],"versions":[{"version":"6.14","status":"affected"},{"version":"0","lessThan":"6.14","status":"unaffected","versionType":"semver"},{"version":"6.18.47","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.11","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2.1","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"6.18.47"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.1.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.2.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.14","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/65aceb45ca91ddb7f7ed178821f481b34da35543"},{"url":"https://git.kernel.org/stable/c/5da21a434171e8ecf1d992c6f1d84c0c706fd395"},{"url":"https://git.kernel.org/stable/c/6db3c1d7e2872c9904e05ca8e0515920776a3c9c"},{"url":"https://git.kernel.org/stable/c/918b8d231c571c50a00efe92ffc8404a537a0490"}],"title":"ALSA: FCP: Use a private URB for the notification endpoint","x_generator":{"engine":"bippy-1.2.0"}}}}