HIGH Introduced in 2.6.12
alsa InputTrigger Race
CVE-2026-90207
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in snd_rawmidi_input_trigger(): snd_rawmidi_input_trigger(up=0) snd_midi_input_event() -> snd_rawmidi_kernel_read() -> snd_rawmidi_input_trigger(up=1) -> cancel_work_sync() which ends with the underlying device being active unexpectedly. When this is called from close_substream(), further input can re-trigger the input event leaving it running after rawmidi_release_priv() has set rfile->rmidi to NULL which leads to: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 Call trace: snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P) snd_rawmidi_input_event_work+0x1c/0x2c process_one_work+0x150/0x3a4 worker_thread+0x190/0x318 Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi: Serialize output teardown with event_input") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1]. With this change in place, midisynth_unsubscribe() clears the input file so snd_midi_input_event() will not re-trigger the stream and will be quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger(). [1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/
02KernelScan AI Analysis
Risk summary
A local user with access to ALSA sequencer MIDI ports can trigger a race condition during MIDI input substream teardown that results in a NULL pointer dereference and kernel panic. The bug requires no special privileges beyond typical audio group membership. Systems without interactive local users or without ALSA MIDI hardware are not affected.
Vulnerability analysis
A race condition exists in the ALSA sequencer MIDI driver between the input substream close path and the MIDI event input callback. When a substream is closing, the input trigger is disabled, but a concurrently running event handler can re-enable it by reading more data from the device. This leaves the device active after the close path has torn down the substream and set internal pointers to NULL, causing a subsequent event callback to dereference a NULL pointer and crash the kernel. The fix serializes teardown with the event handler by clearing the input reference and waiting for in-flight handlers to finish before releasing the substream, while new handlers verify the substream is still valid before proceeding. The vulnerability is reachable by any local user with access to ALSA sequencer MIDI ports, which typically requires only audio group membership and no special kernel capabilities.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 2.6.12 | 6.12.110 | 6290afaae54c |
| 6.18 | 2.6.12 | 6.18.52 | 210c193a9ef1 |
| 7.2 | 2.6.12 | 7.2.6 | 282a3ef9e4b6 |
| mainline | 2.6.12 | 7.3-rc1 | 403f7f3ad380 |
| 6.6 | 2.6.12 | 6.6.157 | 89d986897aff |
| 6.1 | 2.6.12 | 6.1.188 | de76a2b47582 |
| cip/6.12 | 2.6.12 | 6.12.111-cip32 | 6290afaae54c |