CVE-2026-90207

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: midi: Serialize input teardown with event_input

snd_midi_input_event() must not be running while a rawmidi substream is

closing, since this can lead to the trigger state becoming out-of-step

through this sequence in snd_rawmidi_input_trigger():

snd_rawmidi_input_trigger(up=0)

snd_midi_input_event()

-> snd_rawmidi_kernel_read()

-> snd_rawmidi_input_trigger(up=1)

-> cancel_work_sync()

which ends with the underlying device being active unexpectedly.

When this is called from close_substream(), further input can re-trigger

the input event leaving it running after rawmidi_release_priv() has set

rfile->rmidi to NULL which leads to:

Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0

Call trace:

snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P)

snd_rawmidi_input_event_work+0x1c/0x2c

process_one_work+0x150/0x3a4

worker_thread+0x190/0x318

Appl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References