CVE-2026-98316 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: bcd2000: Fix race between rawmidi and disconnect
Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been already running at USB disconnect handling, the in-flight function (e.g. bcd2000_midi_send()) could still access the URB, because the previous URB NULL-check & clearance was considered only for the URB complete callbacks, but not about the parallel rawmidi operations.
For addressing the race, this patch introduced a new spinlock that covers each rawmidi operation as well as the rawmidi handling in the complete callback. The URB is cleared with the lock, so it guarantees that the pending rawmidi task already finished or a NULL check is effective.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel's ALSA subsystem contains a driver for Behringer BCD2000 USB MIDI interfaces that was found to have a race condition leading to potential use-after-free vulnerabilities during device disconnection events. The core issue stems from an incomplete synchronization mechanism within the bcd2000 driver, specifically regarding how it handles concurrent access to Universal Request Block structures used for USB communication. While previous patches attempted to mitigate these risks by nullifying pointers in URB completion callbacks, they failed to account for parallel operations initiated through the rawmidi interface. This oversight allows a scenario where a rawmidi trigger callback is actively executing when a disconnect event occurs, creating a window of opportunity for concurrent access to freed memory structures.
The technical flaw lies in the lack of mutual exclusion between the asynchronous URB completion handlers and the synchronous or interrupt-driven rawmidi operations. When a USB device is disconnected, the kernel initiates cleanup procedures that may free associated data structures. However, if a rawmidi operation such as bcd2000_midi_send is already running on another CPU core or execution context, it continues to reference these now-invalid memory locations because the previous fix only protected against races within the completion callback itself. This race condition results in undefined behavior, typically manifesting as kernel panics, data corruption, or potential privilege escalation if an attacker can control the timing of device removal and input operations.
From a security perspective, this vulnerability is classified under CWE-362, which denotes concurrent execution using shared resources with improper synchronization. The attack vector involves physically removing the USB MIDI interface while it is actively processing audio data streams through rawmidi applications. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as an attacker could potentially leverage the resulting instability to execute arbitrary code or disrupt system availability. The impact extends beyond simple denial of service; use-after-free vulnerabilities are frequently exploited for memory corruption attacks that can lead to remote code execution depending on the specific kernel version and configuration.
To resolve this issue, a new spinlock was introduced into the bcd2000 driver implementation. This lock encompasses all rawmidi operations as well as their handling within the URB complete callback functions. By acquiring this lock before accessing or modifying the URB pointer, the driver ensures that either the pending rawmidi task has completed its execution or a NULL check is effectively enforced during disconnection sequences. This synchronization primitive guarantees atomicity in critical sections where device state changes and data transmission overlap, thereby eliminating the race condition.
System administrators and developers should apply this kernel patch immediately to affected systems utilizing Behringer BCD2000 devices. Mitigation strategies also include ensuring that USB drivers are updated to versions containing proper locking mechanisms for concurrent access patterns. Regular auditing of driver code for similar synchronization gaps in other USB MIDI interfaces is recommended to prevent analogous vulnerabilities across the ALSA subsystem. Maintaining up-to-date kernel packages remains the primary defense against such low-level concurrency bugs that exploit timing differences between hardware events and software state management.