Answer in brief
CVE-2026-90207 records a High severity (CVSS 7.8) vulnerability in ALSA: seq: midi: Serialize input teardown with event_input. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <de76a2b47582cd6dba2e15f024681bf377ecc94a || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <89d986897aff7275b42e075e556731b8353366af || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6290afaae54c7a9fa3bca3b4d5433e6d83e8669d || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <210c193a9ef1312fab153948c6928e4cfaa1f03b || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <403f7f3ad3808a0096d84cf228fab68dc253fd9d | de76a2b47582cd6dba2e15f024681bf377ecc94a, 89d986897aff7275b42e075e556731b8353366af, 6290afaae54c7a9fa3bca3b4d5433e6d83e8669d, 210c193a9ef1312fab153948c6928e4cfaa1f03b, 282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12, 403f7f3ad3808a0096d84cf228fab68dc253fd9d |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 17, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in snd_rawmidi_input_trigger(): snd_rawmidi_input_trigger(up=0) snd_midi_input_event() -> snd_rawmidi_kernel_read() -> snd_rawmidi_input_trigger(up=1) -> cancel_work_sync() which ends with the underlying device being active unexpectedly. When this is called from close_substream(), further input can re-trigger the input event leaving it running after rawmidi_release_priv() has set rfile->rmidi to NULL which leads to: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 Call trace: snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P) snd_rawmidi_input_event_work+0x1c/0x2c process_one_work+0x150/0x3a4 worker_thread+0x190/0x318 Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi: Serialize output teardown with event_input") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1]. With this change in place, midisynth_unsubscribe() clears the input file so snd_midi_input_event() will not re-trigger the stream and will be quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger(). [1] https://lore.kernel.org/linux-sound/[email protected]/
Quoted source text, attributed separately from HOL analysis.