CVE-2026-80828 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Complete cleanup after system-resume errors
A failed system resume can leave the card unusable until reboot. usb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or snd_usb_mixer_resume() fails. The error path skips the out: block, which restores D0 and decrements chip->num_suspended_intf.
The card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in snd_power_ref_and_wait(). USB core logs an interface resume callback error. It does not retry that callback, so a later callback cannot complete the skipped cleanup.
usb_audio_suspend() increments num_suspended_intf before returning success. A system-resume callback must consume the system-suspend count even if a component resume fails. Otherwise, the stranded count skews later suspend and resume cycles.
Do not apply this cleanup to runtime-resume errors. Runtime PM can retry -EAGAIN or -EBUSY without another suspend callback. The count must continue to describe that suspended interface. Other runtime-resume errors latch runtime_error in the PM core and do not cause an immediate callback retry.
Both parts of the system-resume error path are longstanding. Commit 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") introduced err_out past the D0 restore. Commit 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") later moved num_suspended_intf-- into the out: block. The error path now skips both operations.
No third-party code is needed to reach the error path. snd_usb_mixer_resume() ends in snd_usb_mixer_activate(), which returns the result of usb_submit_urb() for devices that have a mixer status URB. Its mixer->private_resume hook can also fail through scarlett2_init_notify(). snd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain. It can return -EPIPE or -EIO when the device stalls the request.
Route a component error through out: only when system_suspend is nonzero. Continue to return runtime-resume errors through err_out. Later component resume stages remain skipped. The original error still reaches USB core. A later transfer can fail if the device did not recover.
I reproduced the system-resume failure on an Audient iD14 MkI with an out-of-tree diagnostic mixer resume hook. An injected -EIO on the unpatched core left control readers in uninterruptible sleep in snd_power_ref_and_wait() until a reboot. With this patch, the same failure restored control access. A second system suspend and resume also succeeded after I disabled fault injection.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel’s ALSA USB audio subsystem contains a critical state management flaw within its power management error handling logic that can render an audio device permanently unusable following a failed system resume operation. This vulnerability stems from the usb_audio_resume function, which is responsible for restoring suspended USB audio interfaces to their active operational states. When specific components such as snd_usb_pcm_resume or snd_usb_mixer_resume encounter errors during this restoration process, the code currently jumps to an error label labeled err_out. However, this jump bypasses a subsequent cleanup block designated as out:, which contains essential operations required to reset the device’s power state and internal counters. Specifically, the skipped block is responsible for restoring the USB interface to the D0 active power state and decrementing the chip->num_suspended_intf counter. By skipping these steps upon an error, the system leaves the audio card in a suspended power state, specifically SNDRV_CTL_POWER_D3hot, rather than returning it to full operation or properly cleaning up its internal tracking structures.
The operational impact of this flaw is severe for end users and system stability. Because the device remains stuck in the D3hot power state, any subsequent attempt by user-space applications or kernel components to access control interfaces will block indefinitely within snd_power_ref_and_wait(). This function waits for a transition from suspend to active that never occurs because the resume process was interrupted without completing its cleanup duties. Consequently, the audio interface becomes unresponsive until the system is rebooted, effectively causing a denial of service for any application relying on that specific USB audio device. Furthermore, the internal counter num_suspended_intf remains skewed; since usb_audio_suspend increments this count upon successful suspension but the corresponding decrement in resume is skipped due to the error path bypass, subsequent suspend and resume cycles may behave unpredictably or fail entirely because the kernel’s power management core has an inaccurate view of which interfaces are currently suspended.
This issue is rooted in historical code changes related to USB autosuspend implementation and previous fixes for inconsistent card power management states. The original introduction of the err_out label placed it before the D0 restore logic, a structural oversight that was partially addressed but not fully corrected when subsequent patches moved the num_suspended_intf decrement into the out: block. As a result, both critical cleanup operations are now skipped during system-resume failures. It is important to distinguish this behavior from runtime power management scenarios. Runtime resume errors should continue to use the err_out path because runtime PM can retry transient errors like -EAGAIN or -EBUSY without requiring another suspend callback, and latching a runtime_error in the PM core does not necessitate immediate cleanup of suspended interface counts. The flaw specifically affects system-level sleep states where the expectation is that all interfaces are restored to full functionality before returning control to the user space.
The vulnerability can be triggered by standard hardware interactions without requiring third-party code or complex exploitation techniques. For instance, snd_usb_mixer_resume may fail if usb_submit_urb returns an error for devices with a mixer status URB, or through specific driver hooks like scarlett2_init_notify that can explicitly return failure codes. Similarly, snd_usb_pcm_resume issues SET_CUR requests to Universal Audio Class 3 power domains and may receive -EPIPE or -EIO responses when the device stalls these requests due to hardware faults or firmware bugs. These conditions are not rare anomalies but represent valid error paths in USB communication protocols that must be handled gracefully by the driver. The lack of proper cleanup means that even if the underlying hardware issue is transient, the software state remains corrupted until a reboot clears it.
To mitigate this vulnerability and restore robustness to the ALSA USB audio subsystem, developers have implemented a fix that routes component errors through the out: block specifically when system_suspend is non-zero. This ensures that regardless of whether a resume operation succeeds or fails for individual components, the necessary cleanup steps are always executed during system-resume sequences. The original error code is still returned to the USB core so that higher-level power management logic remains aware of the failure, but the critical housekeeping tasks of restoring D0 state and adjusting suspended interface counts proceed unconditionally in this context. This approach preserves correct behavior for runtime resume errors while fixing the systemic issue with system-wide sleep transitions. Users relying on affected hardware should apply kernel updates containing this patch to prevent indefinite hangs during control access following wake-from-suspend events, thereby ensuring continuous availability of audio interfaces without requiring manual intervention or reboots.