---
id: CVE-2026-90207
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: seq: midi: Serialize input teardown with event_input

  snd_midi_input_event() must not be running while a rawmidi substream is
  closing, since this can lead to the …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: seq: midi: Serialize input teardown with event_input

  snd_midi_input_event() must not be running while a rawmidi substream is
  closing, since this can lead to the …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    de76a2b47582cd6dba2e15f024681bf377ecc94a
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    89d986897aff7275b42e075e556731b8353366af
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    6290afaae54c7a9fa3bca3b4d5433e6d83e8669d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    210c193a9ef1312fab153948c6928e4cfaa1f03b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    403f7f3ad3808a0096d84cf228fab68dc253fd9d
  - Linux 2.6.12
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:46.560'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90207'
references:
  - url: 'https://git.kernel.org/stable/c/210c193a9ef1312fab153948c6928e4cfaa1f03b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/403f7f3ad3808a0096d84cf228fab68dc253fd9d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6290afaae54c7a9fa3bca3b4d5433e6d83e8669d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/89d986897aff7275b42e075e556731b8353366af'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/de76a2b47582cd6dba2e15f024681bf377ecc94a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00176
epssPercentile: 0.06352
ingestedAt: '2026-09-17T16:21:47.859Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: midi: Serialize input teardown with event_input

snd_midi_input_event() must not be running while a rawmidi substream is
closing, since this can lead to the trigger state becoming out-of-step
through this sequence in snd_rawmidi_input_trigger():

	snd_rawmidi_input_trigger(up=0)
					snd_midi_input_event()
					 -> snd_rawmidi_kernel_read()
					     -> snd_rawmidi_input_trigger(up=1)
	  -> cancel_work_sync()

which ends with the underlying device being active unexpectedly.

When this is called from close_substream(), further input can re-trigger
the input event leaving it running after rawmidi_release_priv() has set
rfile->rmidi to NULL which leads to:

	Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0
	Call trace:
	 snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P)
	 snd_rawmidi_input_event_work+0x1c/0x2c
	 process_one_work+0x150/0x3a4
	 worker_thread+0x190/0x318

Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi:
Serialize output teardown with event_input") which fixed the same issue
in the output direction, but updated to use RCU following Takashi Iwai's
proposed follow-on patch [1].

With this change in place, midisynth_unsubscribe() clears the input file
so snd_midi_input_event() will not re-trigger the stream and will be
quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger().

[1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.