---
id: CVE-2026-80816
title: 'ALSA: FCP: Use a private URB for the notification endpoint'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: FCP: Use a private URB for the notification endpoint

  fcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()
  allocates for the optional UAC2 statu…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 <
    65aceb45ca91ddb7f7ed178821f481b34da35543
  - >-
    Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 <
    5da21a434171e8ecf1d992c6f1d84c0c706fd395
  - >-
    Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 <
    6db3c1d7e2872c9904e05ca8e0515920776a3c9c
  - >-
    Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 <
    918b8d231c571c50a00efe92ffc8404a537a0490
  - Linux 6.14
published: '2026-09-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:44:09.982Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80816'
references:
  - url: 'https://git.kernel.org/stable/c/65aceb45ca91ddb7f7ed178821f481b34da35543'
  - url: 'https://git.kernel.org/stable/c/5da21a434171e8ecf1d992c6f1d84c0c706fd395'
  - url: 'https://git.kernel.org/stable/c/6db3c1d7e2872c9904e05ca8e0515920776a3c9c'
  - url: 'https://git.kernel.org/stable/c/918b8d231c571c50a00efe92ffc8404a537a0490'
tags:
  - cve.org
epss: 0.00209
epssPercentile: 0.10312
ingestedAt: '2026-10-19T09:16:01.506Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: FCP: Use a private URB for the notification endpoint

fcp_init_notify() used mixer->urb, which snd_usb_mixer_status_create()
allocates for the optional UAC2 status interrupt endpoint and mixer.c
kills, resubmits and frees. On a device with that endpoint,
fcp_init_notify()'s "already set up" early return fires on the status
URB and returns success without doing anything. No FCP notification
URB is submitted, and cmd_done is left zeroed because it is
initialised past that early return and nowhere else. fcp_init() then
issues init1_opcode and wait_for_completion_timeout() would crash
adding to the zeroed wait.head. fcp_cleanup_urb() would also kill and
free mixer.c's status URB.

Use a separate URB in fcp_data, and initialise cmd_done in
fcp_init_private() where fcp_data is allocated. fcp_init_notify() is
reached again after suspend via fcp_reinit(), and the URB kill path in
fcp_notify() completes cmd_done, leaving a stale count that would
satisfy the next command's wait before the device ACKs. Use
reinit_completion() to clear it.

## Affected

- `Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 65aceb45ca91ddb7f7ed178821f481b34da35543`
- `Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 5da21a434171e8ecf1d992c6f1d84c0c706fd395`
- `Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 6db3c1d7e2872c9904e05ca8e0515920776a3c9c`
- `Linux >= 46757a3e7d50dac923888e7fbe68377736f13c70 < 918b8d231c571c50a00efe92ffc8404a537a0490`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.