Executive brief
The Linux kernel's ALSA audio driver for the Behringer BCD2000 MIDI device contains a use-after-free vulnerability that can be triggered when a connected device is disconnected while an audio stream is still active. An attacker with physical access to a system can exploit this to crash the kernel or potentially execute arbitrary code, disrupting audio services and compromising system stability.
Technical details
The vulnerability exists in the bcd2000_free_usb_related_resources() function, which frees URB (USB Request Block) data structures but does not clear the pointers referencing them. After freeing, the rawmidi device can still call bcd2000_midi_send() from its trigger path during stream closure, causing writes to freed memory and submission of freed URBs to the USB core. The issue is exposed in both output (via bcd2000_midi_send()) and input (via bcd2000_input_complete()) paths. The fix involves poisoning URBs with usb_poison_urb() before freeing to reject any later submissions, and clearing the pointers after freeing, with guard checks before access. The vulnerability requires the device to remain connected during stream close to trigger the race condition.
Affected products
- Linux Linux kernel 7.2.0-rc5 and other versions
Timeline
- 2026-09-11: disclosed