CVE-2026-80971
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel ALSA bcd2000 driver, the USB resource cleanup function freed URB structures without clearing the pointers. An open rawmidi substream could access freed memory (use-after-free) after device disconnect, leading to kernel memory corruption.
Risk Assessment
This use-after-free in the kernel can cause a system crash (panic) or potentially allow arbitrary code execution with kernel privileges if exploited by a local user with access to the bcd2000 device.
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2026-80971. Until patched, avoid using bcd2000 devices or restrict access to trusted users only.
Related vulnerabilities
- CVE-2026-103409Critical
A missing authentication for a critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. The vulnerability can only be exploited prior to the device being onboarded to Mist/Conductor; it can no longer be exploited once the device is onboarded.
- CVE-2026-103406Critical
An improper neutralization of special elements used in an OS command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
- CVE-2026-44179Critical
The `excerpt-include` macro in XWiki Remote Macros does not properly escape the included page's title and executes `excerpt` content with the macro's rights. Both the title handling and the rendering of `excerpt` content into XWiki syntax allow syntax injection. Any user able to edit a page, even without script rights, can supply executable macro syntax and cause remote code execution when the page is included.
- CVE-2026-115968Critical
A deserialization of untrusted data vulnerability in the Ultimate Member WordPress plugin allows Object Injection. Affects versions up to and including 2.13.1.
- CVE-2026-105420Critical
Wing FTP Server does not verify the user's base folder, allowing an attacker with admin privileges to add user directories via scripts that escape the base folder. This enables file writes on the system and potential remote code execution with process owner privileges, and with sudo-based installation files are created as root. Fixed in version 8.2.6.
- CVE-2026-67074Critical
HCL BigFix AEX is affected by a Remote Code Execution (RCE) vulnerability. An attacker may execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.
- CVE-2026-115904Critical
Topluyo Desktop for Linux prior to version 2026.9.2410 unsafely processes user-controlled URLs, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.
- CVE-2026-115607Critical
The Crowd Favorite DXP ToolKit plugin contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects DXP ToolKit versions from n/a through 2.0.1.
- CVE-2026-111411Critical
The Aman FunnelKit Automations (wp-marketing-automations) plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects FunnelKit Automations versions from n/a through 3.8.5.2.
- CVE-2026-118477Critical
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. An authenticated attacker can execute arbitrary commands with www-data privileges. Fixed in version 2026061802.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000_free_usb_related_resources() frees both URBs and leaves the pointers behind: usb_kill_urb(bcd2k->midi_out_urb); usb_kill_urb(bcd2k->midi_in_urb); usb_free_urb(bcd2k->midi_out_urb); usb_free_urb(bcd2k->midi_in_urb); The rawmidi device outlives that call. A substream that is still open when the device is unplugged reaches bcd2000_midi_send() from the trigger path on close. That function writes to the freed URB and then hands it to the USB core: bcd2k->midi_out_urb->transfer_buffer_length = BUFSIZE; ... ret = usb_submit_urb(bcd2k->midi_out_urb, GFP_ATOMIC); usb_kill_urb() does not stop a later submission either, so a submit that races the disconnect can requeue the URB after it has been reaped. midi_in_urb is exposed the same way: bcd2000_input_complete() resubmits it from the completion handler. KASAN on 7.2.0-rc5 (arm64): BUG: KASAN: slab-use-after-free in bcd2000_midi_send [snd_bcd2000] Write of size 4 at addr ffff00001827d388 by task bpoc/168 __asan_store4 bcd2000_midi_send [snd_bcd2000] bcd2000_midi_output_trigger [snd_bcd2000] snd_rawmidi_kernel_write1 close_substream.part.0 Freed by task 168: usb_free_urb bcd2000_disconnect [snd_bcd2000] BUG: KASAN: slab-use-after-free in usb_submit_urb Read of size 8 at addr ffff00001827d3b8 by task bpoc/168 Clear both pointers after freeing and test them on the paths that can still run. Poison the URBs before freeing them: usb_poison_urb() waits for a running completion handler and rejects any later submission, so after it returns the input path is quiesced and only the rawmidi trigger path can still reach bcd2000_midi_send(). No unpoison is needed; the URBs are freed on the next line. Discovered by XBOW, triaged by Baul Lee <[email protected]>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS