CVE-2026-90207ALSA: seq: midi: Serialize input teardown with event_input
- 7.8HighCVSS base score
- 0.17%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in snd_rawmidi_input_trigger(): snd_rawmidi_input_trigger(up=0) snd_midi_input_event() -> snd_rawmidi_kernel_read() -> snd_rawmidi_input_trigger(up=1) -> cancel_work_sync() which ends with the underlying device being active unexpectedly. When this is called from close_substream(), further input can re-trigger the input event leaving it running after rawmidi_release_priv() has set rfile->rmidi to NULL which leads to: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 Call trace: snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P) snd_rawmidi_input_event_work+0x1c/0x2c process_one_work+0x150/0x3a4 worker_thread+0x190/0x318 Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi: Serialize output teardown with event_input") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1]. With this change in place, midisynth_unsubscribe() clears the input file so snd_midi_input_event() will not re-trigger the stream and will be quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger(). [1] https://lore.kernel.org/linux-sound/[email protected]/
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 32 days later
· 32 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < de76a2b47582cd6dba2e15f024681bf377ecc94a
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 89d986897aff7275b42e075e556731b8353366af
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 6290afaae54c7a9fa3bca3b4d5433e6d83e8669d
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 210c193a9ef1312fab153948c6928e4cfaa1f03b
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12
- affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 403f7f3ad3808a0096d84cf228fab68dc253fd9d
- affected 2.6.12
- unaffected < 2.6.12
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.52 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/de76a2b47582cd6dba2e15f024681bf377ecc94a (opens in a new tab)
- https://git.kernel.org/stable/c/89d986897aff7275b42e075e556731b8353366af (opens in a new tab)
- https://git.kernel.org/stable/c/6290afaae54c7a9fa3bca3b4d5433e6d83e8669d (opens in a new tab)
- https://git.kernel.org/stable/c/210c193a9ef1312fab153948c6928e4cfaa1f03b (opens in a new tab)
- https://git.kernel.org/stable/c/282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12 (opens in a new tab)
- https://git.kernel.org/stable/c/403f7f3ad3808a0096d84cf228fab68dc253fd9d (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-81800 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-90207)Record last updated .