Executive brief
The Linux kernel's ALSA Focusrite Control Protocol (FCP) driver incorrectly shared a USB endpoint request block (URB) with the USB mixer status handler, causing it to be freed and reused while still in use. This leads to kernel crashes and unpredictable behavior when USB audio devices with optional status endpoints are connected, potentially disrupting audio service availability on affected systems.
Technical details
The vulnerability is a use-after-free bug in the ALSA FCP driver (sound/usb/fcp.c). The root cause is that fcp_init_notify() incorrectly reused mixer->urb, which is allocated and freed by the USB mixer status handler. On devices with a UAC2 status interrupt endpoint, the FCP notification URB check would incorrectly return early thinking the URB was already set up, leaving cmd_done uninitialized. When fcp_init() later called wait_for_completion_timeout() on the zeroed wait queue head, it would crash. Additionally, fcp_cleanup_urb() would kill and free the mixer's status URB, causing use-after-free. The fix allocates a separate URB in fcp_data, initializes cmd_done in fcp_init_private(), and uses reinit_completion() after device suspend to clear stale completion counts. The attack vector is local/adjacent (physical device connection) with no authentication required.
Affected products
- Linux Linux kernel Linux 5.11 and later (affected by the FCP driver introduced in commit 46757a3e7d50)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched: Patch committed by Greg Kroah-Hartman (commit 5da21a434171e8ecf1d992c6f1d84c0c706fd395 and 65aceb45ca91ddb7f7ed178821f481b34da35543)