---
id: CVE-2026-80815
title: 'ALSA: scarlett2: Use a private URB for the notification endpoint'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: scarlett2: Use a private URB for the notification endpoint

  scarlett2_init_notify() used mixer->urb, which
  snd_usb_mixer_status_create() allocates for the UAC2 st…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb <
    013448eb7b0d0b91d6168685dab10e9b41baa825
  - >-
    Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb <
    4305e4b52acc0ca67dcfdf8f73dd943dab508ae8
  - >-
    Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb <
    04df0232a6976845cd9c9e83b6c26215759be667
  - >-
    Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb <
    ecd2f83a4ddc078901e7104144cb6c5e5db3b7cf
  - >-
    Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb <
    cd17d6ff7b7d2b1dd9bcc80ae7b4a83773f918c6
  - Linux 6.10
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:09.029Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80815'
references:
  - url: 'https://git.kernel.org/stable/c/013448eb7b0d0b91d6168685dab10e9b41baa825'
  - url: 'https://git.kernel.org/stable/c/4305e4b52acc0ca67dcfdf8f73dd943dab508ae8'
  - url: 'https://git.kernel.org/stable/c/04df0232a6976845cd9c9e83b6c26215759be667'
  - url: 'https://git.kernel.org/stable/c/ecd2f83a4ddc078901e7104144cb6c5e5db3b7cf'
  - url: 'https://git.kernel.org/stable/c/cd17d6ff7b7d2b1dd9bcc80ae7b4a83773f918c6'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.0569
ingestedAt: '2026-10-19T09:16:01.507Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: scarlett2: Use a private URB for the notification endpoint

scarlett2_init_notify() used mixer->urb, which
snd_usb_mixer_status_create() allocates for the UAC2 status interrupt
endpoint and mixer.c manages. On a device with that endpoint, the
"already in use" check fires on the status URB and returns 0 for
success without doing anything. No notification URB is submitted, and
cmd_done is left zeroed because it is initialised past that check and
nowhere else. scarlett2_usb_init() then issues SCARLETT2_USB_INIT_1
and wait_for_completion_timeout() would crash adding to the zeroed
wait.head.

Use a separate URB in scarlett2_data, as done for FCP, and initialise
cmd_done in scarlett2_init_private(). mixer.c was also freeing the URB
in snd_usb_mixer_free() and resubmitting it in
snd_usb_mixer_activate(), so scarlett2 must now do both: add
scarlett2_cleanup_urb(), called from private_free and private_suspend,
and a private_resume callback to re-establish the URB after resume.
scarlett2_init_notify() is reached from there, and the URB kill path
in scarlett2_notify() completes cmd_done, leaving a stale count that
would satisfy the next command's wait before the device ACKs. Use
reinit_completion() to clear it.

Also free the URB if the transfer buffer allocation fails, and both if
usb_submit_urb() fails. Move scarlett2_init_notify() up next to
scarlett2_cleanup_urb() so scarlett2_init_private() can reference it
without a forward declaration.

## Affected

- `Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb < 013448eb7b0d0b91d6168685dab10e9b41baa825`
- `Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb < 4305e4b52acc0ca67dcfdf8f73dd943dab508ae8`
- `Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb < 04df0232a6976845cd9c9e83b6c26215759be667`
- `Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb < ecd2f83a4ddc078901e7104144cb6c5e5db3b7cf`
- `Linux >= 1b65088958cadab04d5d34a8615e2466b1b48ecb < cd17d6ff7b7d2b1dd9bcc80ae7b4a83773f918c6`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.