{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ALSA: seq: midi: Serialize input teardown with event_input  snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in snd_rawmidi_input_trigger():  \tsnd_rawmidi_input_trigger(up=0) \t\t\t\t\tsnd_midi_input_event() \t\t\t\t\t -\u003e snd_rawmidi_kernel_read() \t\t\t\t\t     -\u003e snd_rawmidi_input_trigger(up=1) \t  -\u003e cancel_work_sync()  which ends with the underlying device being active unexpectedly.  When this is called from close_substream(), further input can re-trigger the input event leaving it running after rawmidi_release_priv() has set rfile-\u003ermidi to NULL which leads to:  \tUnable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 \tCall trace: \t snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P) \t snd_rawmidi_input_event_work+0x1c/0x2c \t process_one_work+0x150/0x3a4 \t worker_thread+0x190/0x318  Apply a similar approach to commit ef7607ab1c8ad (\"ALSA: seq: midi: Serialize output teardown with event_input\") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1].  With this change in place, midisynth_unsubscribe() clears the input file so snd_midi_input_event() will not re-trigger the stream and will be quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger().  [1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/",
  "id": "DEBIAN-CVE-2026-90207",
  "modified": "2026-09-18T04:47:35.011240440Z",
  "published": "2026-09-17T17:17:15.813Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90207"
    }
  ],
  "upstream": [
    "CVE-2026-90207"
  ]
}