CVE-2026-80828: ALSA: usb-audio: Complete cleanup after system-resume errors
Noroxi assessment
Priority: Monitor (action score 0/100)
- The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
- Probability of exploitation in the next 30 days: 0.19% (FIRST EPSS).
- Fixed version: Linux Linux 1739a976312e110c93a8dee66a1cdf893a1b187e, 3f06f3f5b16212f180764654a9398ff5f7a855c8, 3fa521c3c54b42e16cad8ade76551113a783752b; azl3 kernel 6.6.152.1-1 on Azure Linux 3.0 6.6.157.1-1.
Low priority for now. Upgrade to Linux Linux 1739a976312e110c93a8dee66a1cdf893a1b187e, 3f06f3f5b16212f180764654a9398ff5f7a855c8, 3fa521c3c54b42e16cad8ade76551113a783752b; azl3 kernel 6.6.152.1-1 on Azure Linux 3.0 6.6.157.1-1 or later.
Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it
Primary sources: NVD · CVE.org · FIRST EPSS
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or snd_usb_mixer_resume() fails. The error path skips the out: block, which restores D0 and decrements chip->num_suspended_intf. The card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in snd_power_ref_and_wait(). USB core logs an interface resume callback error. It does not retry that callback, so a later callback cannot complete the skipped cleanup. usb_audio_suspend() increments num_suspended_intf before returning success. A system-resume callback must consume the system-suspend count even if a component resume fails. Otherwise, the stranded count skews later suspend and resume cycles. Do not apply this cleanup to runtime-resume errors. Runtime PM can retry -EAGAIN or -EBUSY without another suspend callback. The count must continue to describe that suspended interface. Other runtime-resume errors latch runtime_error in the PM core and do not cause an immediate callback retry. Both parts of the system-resume error path are longstanding. Commit 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") introduced err_out past the D0 restore. Commit 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") later moved num_suspended_intf-- into the out: block. The error path now skips both operations. No third-party code is needed to reach the error path. snd_usb_mixer_resume() ends in snd_usb_mixer_activate(), which returns the result of usb_submit_urb() for devices that have a mixer status URB. Its mixer->private_resume hook can also fail through scarlett2_init_notify(). snd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain. It can return -EPIPE or -EIO when the device stalls the request. Route a component error through out: only when system_suspend is nonzero. Continue to return runtime-resume errors through err_out. Later component resume stages remain skipped. The original error still reaches USB core. A later transfer can fail if the device did not recover. I reproduced the system-resume failure on an Audient iD14 MkI with an out-of-tree diagnostic mixer resume hook. An injected -EIO on the unpatched core left control readers in uninterruptible sleep in snd_power_ref_and_wait() until a reboot. With this patch, the same failure restored control access. A second system suspend and resume also succeeded after I disabled fault injection.
- Published
- Sep 4, 2026
- Updated
- Oct 19, 2026
- EPSS
- 0.1% · 8th percentile
- CWE
- —
Report tools
Action score
0
Monitor
Low priority for now.
- CVSS
- 0 / 40 · —
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.1%
Get told when this record changes
- Not in KEV: no record of exploitation in the wild
- No public exploit code on record
- A fix has been released
If any of these changes, we'll tell you in the daily email digest.
Running WordPress? Scan your site free with WP Lens
Noroxi analysis
What does it mean in your environment?
The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.
We use this product, ask for helpAffected systems
Is your version affected?
Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.
—
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 2.6.39affected
- 88a8516a2128a6d078a106ead48092240e8a138f and later · before 3fa521c3c54b42e16cad8ade76551113a783752baffected · git
- 88a8516a2128a6d078a106ead48092240e8a138f and later · before 3f06f3f5b16212f180764654a9398ff5f7a855c8affected · git
- 88a8516a2128a6d078a106ead48092240e8a138f and later · before f1c05c41d07b874635d681ae328d13ec550470c5affected · git
- 88a8516a2128a6d078a106ead48092240e8a138f and later · before 5a625fc2284e35f33693efd9534aebaca3b005d4affected · git
- 88a8516a2128a6d078a106ead48092240e8a138f and later · before 6d3e202670b819c414076a5d07dffac8a39274adaffected · git
- 88a8516a2128a6d078a106ead48092240e8a138f and later · before 6c94877b6bab9185898bcad4b082ff5592558921affected · git
- 88a8516a2128a6d078a106ead48092240e8a138f and later · before d1f643b1c0258bd519146f7a342bbb394d413912affected · git
- 88a8516a2128a6d078a106ead48092240e8a138f and later · before 1739a976312e110c93a8dee66a1cdf893a1b187eaffected · git
- before 2.6.39not affected · semver
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| Debian:12 | linux | before 6.1.187-1 | 6.1.187-1 |
| Debian:12 | linux-6.12 | before 6.12.111-1~deb12u1 | 6.12.111-1~deb12u1 |
| Debian:13 | linux | before 6.12.111-1 | 6.12.111-1 |
| Debian:14 | linux | before 7.1.13-1 | 7.1.13-1 |
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation40Plan
- CVE-2026-74612veth: fix skb length accounting after XDP frag adjustment40Plan
- CVE-2026-74475vxlan: use neigh_ha_snapshot() in route_shortcircuit()40Plan
Published before and after this one in the same product
- ← EarlierCVE-2026-80826Sep 4, 2026 · USB: c67x00: fix use-after-free in c67x00_add_iso_urb()0Monitor
- ← EarlierCVE-2026-80827Sep 4, 2026 · USB: serial: option: fix slab OOB read in interrupt URB callback0Monitor
- Later →CVE-2026-80829Sep 4, 2026 · ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()0Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 1739a976312e110c93a8dee66a1cdf893a1b187e | Vendor (CNA) |
| Linux Linux | 3f06f3f5b16212f180764654a9398ff5f7a855c8 | Vendor (CNA) |
| Linux Linux | 3fa521c3c54b42e16cad8ade76551113a783752b | Vendor (CNA) |
| Linux Linux | 5a625fc2284e35f33693efd9534aebaca3b005d4 | Vendor (CNA) |
| Linux Linux | 6c94877b6bab9185898bcad4b082ff5592558921 | Vendor (CNA) |
| Linux Linux | 6d3e202670b819c414076a5d07dffac8a39274ad | Vendor (CNA) |
| Linux Linux | d1f643b1c0258bd519146f7a342bbb394d413912 | Vendor (CNA) |
| Linux Linux | f1c05c41d07b874635d681ae328d13ec550470c5 | Vendor (CNA) |
| azl3 kernel 6.6.150.1-1 on Azure Linux 3.0 | — | Microsoft (MSRC) |
| azl3 kernel 6.6.152.1-1 on Azure Linux 3.0 | 6.6.157.1-1 · Release Notes | Microsoft (MSRC) |
| debian:linux | 6.1.187-1 · Debian:12 | Package registry (OSV) |
| debian:linux-6.12 | 6.12.111-1~deb12u1 · Debian:12 | Package registry (OSV) |
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
No commit or PR link among the references.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
No credits in the CNA record.
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
No nightly-computed relations.
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
No known public program.
Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).
Technical details
No CVSS vector for this record, so attack conditions can't be derived.
Weakness class (CWE)
—
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
MITRE has no CAPEC/ATT&CK mapping for this CWE.
Change log
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
Show all references (7 more)Show less
- git.kernel.org/stable/c/3f06f3f5b16212f180764654a9398ff5f7a855c8
- git.kernel.org/stable/c/3fa521c3c54b42e16cad8ade76551113a783752b
- git.kernel.org/stable/c/5a625fc2284e35f33693efd9534aebaca3b005d4
- git.kernel.org/stable/c/6c94877b6bab9185898bcad4b082ff5592558921
- git.kernel.org/stable/c/6d3e202670b819c414076a5d07dffac8a39274ad
- git.kernel.org/stable/c/d1f643b1c0258bd519146f7a342bbb394d413912
- git.kernel.org/stable/c/f1c05c41d07b874635d681ae328d13ec550470c5
Vendor advisories and official records. Exploit/PoC links are deliberately left out.