CVE-2026-90207

CVE CVE-2026-90207EUVD EUVD-2026-81800Published 2026-09-17T16:07:22.000ZLast changed 2026-09-18T17:53:45.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in snd_rawmidi_input_trigger(): snd_rawmidi_input_trigger(up=0) snd_midi_input_event() -> snd_rawmidi_kernel_read() -> snd_rawmidi_input_trigger(up=1) -> cancel_work_sync() which ends with the underlying device being active unexpectedly. When this is called from close_substream(), further input can re-trigger the input event leaving it running after rawmidi_release_priv() has set rfile->rmidi to NULL which leads to: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 Call trace: snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P) snd_rawmidi_input_event_work+0x1c/0x2c process_one_work+0x150/0x3a4 worker_thread+0x190/0x318 Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi: Serialize output teardown with event_input") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1]. With this change in place, midisynth_unsubscribe() clears the input file so snd_midi_input_event() will not re-trigger the stream and will be quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger(). [1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <89d986897aff7275b42e075e556731b8353366af; patch: 6.6.157; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <de76a2b47582cd6dba2e15f024681bf377ecc94a; patch: 0; patch: 6.18.52; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <210c193a9ef1312fab153948c6928e4cfaa1f03b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6290afaae54c7a9fa3bca3b4d5433e6d83e8669d; patch: 7.2.6; patch: 6.12.110; 2.6.12; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <403f7f3ad3808a0096d84cf228fab68dc253fd9d; patch: 7.3-rc1; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12; patch: 6.1.188

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.