{"id":"CVE-2026-80816","title":"ALSA: FCP: Use a private URB for the notification endpoint","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: FCP: Use a private URB for the notification endpoint\n\nfcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()\nallocates for the optional UAC2 statu…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 65aceb45ca91ddb7f7ed178821f481b34da35543","Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 5da21a434171e8ecf1d992c6f1d84c0c706fd395","Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 6db3c1d7e2872c9904e05ca8e0515920776a3c9c","Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 918b8d231c571c50a00efe92ffc8404a537a0490","Linux 6.14"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:44:09.982Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80816","references":[{"url":"https://git.kernel.org/stable/c/65aceb45ca91ddb7f7ed178821f481b34da35543"},{"url":"https://git.kernel.org/stable/c/5da21a434171e8ecf1d992c6f1d84c0c706fd395"},{"url":"https://git.kernel.org/stable/c/6db3c1d7e2872c9904e05ca8e0515920776a3c9c"},{"url":"https://git.kernel.org/stable/c/918b8d231c571c50a00efe92ffc8404a537a0490"}],"tags":["cve.org"],"epss":0.00209,"epssPercentile":0.10312,"ingestedAt":"2026-10-19T09:16:01.506Z","slug":"CVE-2026-80816","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nALSA: FCP: Use a private URB for the notification endpoint\n\nfcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()\nallocates for the optional UAC2 status interrupt endpoint and mixer.c\nkills, resubmits and frees. On a device with that endpoint,\nfcp_init_notify()'s \"already set up\" early return fires on the status\nURB and returns success without doing anything. No FCP notification\nURB is submitted, and cmd_done is left zeroed because it is\ninitialised past that early return and nowhere else. fcp_init() then\nissues init1_opcode and wait_for_completion_timeout() would crash\nadding to the zeroed wait.head. fcp_cleanup_urb() would also kill and\nfree mixer.c's status URB.\n\nUse a separate URB in fcp_data, and initialise cmd_done in\nfcp_init_private() where fcp_data is allocated. fcp_init_notify() is\nreached again after suspend via fcp_reinit(), and the URB kill path in\nfcp_notify() completes cmd_done, leaving a stale count that would\nsatisfy the next command's wait before the device ACKs. Use\nreinit_completion() to clear it.\n\n## Affected\n\n- `Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 65aceb45ca91ddb7f7ed178821f481b34da35543`\n- `Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 5da21a434171e8ecf1d992c6f1d84c0c706fd395`\n- `Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 6db3c1d7e2872c9904e05ca8e0515920776a3c9c`\n- `Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 918b8d231c571c50a00efe92ffc8404a537a0490`\n- `Linux 6.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}