CVE-2026-80828

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Complete cleanup after system-resume errors

A failed system resume can leave the card unusable until reboot.

usb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or

snd_usb_mixer_resume() fails. The error path skips the out: block, which

restores D0 and decrements chip->num_suspended_intf.

The card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in

snd_power_ref_and_wait(). USB core logs an interface resume callback error.

It does not retry that callback, so a later callback cannot complete the

skipped cleanup.

usb_audio_suspend() increments num_suspended_intf before returning success.

A system-resume callback must consume the system-suspend count even if a

component resume fails. Otherwise, the stranded count skews later suspend

and resume cycles.

Do not apply this cleanup to runtime-resume errors. Runtime PM can retry

-EAGAIN or -EBUSY without another suspend callback. Th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References