In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: midi: Serialize input teardown with event_input

snd_midi_input_event() must not be running while a rawmidi substream is
closing, since this can lead to the trigger state becoming out-of-step
through this sequence in snd_rawmidi_input_trigger():

snd_rawmidi_input_trigger(up=0)
snd_midi_input_event()
-> snd_rawmidi_kernel_read()
-> snd_rawmidi_input_trigger(up=1)
-> cancel_work_sync()

which ends with the underlying device being active unexpectedly.

When this is called from close_substream(), further input can re-trigger
the input event leaving it running after rawmidi_release_priv() has set
rfile->rmidi to NULL which leads to:

Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0
Call trace:
snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P)
snd_rawmidi_input_event_work+0x1c/0x2c
process_one_work+0x150/0x3a4
worker_thread+0x190/0x318

Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi:
Serialize output teardown with event_input") which fixed the same issue
in the output direction, but updated to use RCU following Takashi Iwai's
proposed follow-on patch [1].

With this change in place, midisynth_unsubscribe() clears the input file
so snd_midi_input_event() will not re-trigger the stream and will be
quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger().

[1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < de76a2b47582cd6dba2e15f024681bf377ecc94a
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 89d986897aff7275b42e075e556731b8353366af
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 6290afaae54c7a9fa3bca3b4d5433e6d83e8669d
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 210c193a9ef1312fab153948c6928e4cfaa1f03b
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 403f7f3ad3808a0096d84cf228fab68dc253fd9d
Linux Linux affected
Version Status Constraints
2.6.12 affected —
0 unaffected < 2.6.12
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/210c193a9ef1312fab153948c6928e4cfaa1f03b cve-icon
https://git.kernel.org/stable/c/282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12 cve-icon
https://git.kernel.org/stable/c/403f7f3ad3808a0096d84cf228fab68dc253fd9d cve-icon
https://git.kernel.org/stable/c/6290afaae54c7a9fa3bca3b4d5433e6d83e8669d cve-icon
https://git.kernel.org/stable/c/89d986897aff7275b42e075e556731b8353366af cve-icon
https://git.kernel.org/stable/c/de76a2b47582cd6dba2e15f024681bf377ecc94a cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in snd_rawmidi_input_trigger(): snd_rawmidi_input_trigger(up=0) snd_midi_input_event() -> snd_rawmidi_kernel_read() -> snd_rawmidi_input_trigger(up=1) -> cancel_work_sync() which ends with the underlying device being active unexpectedly. When this is called from close_substream(), further input can re-trigger the input event leaving it running after rawmidi_release_priv() has set rfile->rmidi to NULL which leads to: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 Call trace: snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P) snd_rawmidi_input_event_work+0x1c/0x2c process_one_work+0x150/0x3a4 worker_thread+0x190/0x318 Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi: Serialize output teardown with event_input") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1]. With this change in place, midisynth_unsubscribe() clears the input file so snd_midi_input_event() will not re-trigger the stream and will be quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger(). [1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/
Title ALSA: seq: midi: Serialize input teardown with event_input
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:07:22.825Z

Reserved: 2026-09-11T19:38:34.793Z

Link: CVE-2026-90207

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.