CVE-2026-80828: Linux Kernel ALSA USB Audio DOS Vulnerability

CVE-2026-80828 Overview

CVE-2026-80828 is a Linux kernel vulnerability in the ALSA USB audio subsystem. A failed system resume in usb_audio_resume() skips the cleanup path when snd_usb_pcm_resume() or snd_usb_mixer_resume() returns an error. The card remains in SNDRV_CTL_POWER_D3hot, and chip->num_suspended_intf is not decremented. Subsequent control access blocks indefinitely in snd_power_ref_and_wait(), leaving the audio card unusable until reboot. The USB core does not retry the interface resume callback, so no later callback recovers the skipped cleanup.

Critical Impact
A failed component resume during system wake leaves USB audio devices in an unusable state, causing readers of ALSA controls to enter uninterruptible sleep until the system is rebooted.

Affected Products

Linux kernel with the ALSA usb-audio driver
Systems using USB audio devices subject to system suspend and resume cycles
Distributions shipping kernels prior to the fixes referenced in the stable tree commits

Discovery Timeline

2026-09-04 - CVE-2026-80828 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80828

Vulnerability Analysis

The defect is a kernel resource-state management bug in sound/usb/card.c. usb_audio_suspend() increments num_suspended_intf on success. On resume, usb_audio_resume() must consume that suspend count and restore the device to D0, even when a component resume stage fails. The current error path jumps to err_out, bypassing the out: block that performs both operations.

Two component resume functions can fail. snd_usb_mixer_resume() terminates in snd_usb_mixer_activate(), which returns the result of usb_submit_urb() for devices exposing a mixer status URB. The mixer->private_resume hook can also fail through scarlett2_init_notify(). snd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain, which may return -EPIPE or -EIO if the device stalls.

Once cleanup is skipped, the card remains marked suspended. Any userspace process reading or writing an ALSA control blocks in snd_power_ref_and_wait() in uninterruptible sleep. The stranded num_suspended_intf counter also skews later suspend and resume cycles.

Root Cause

The root cause is an incomplete error handler introduced across two historical commits. Commit 88a8516a2128a ("ALSA: usbaudio: implement USB autosuspend") added err_out before the D0 restore. Commit 862b2509d157c ("ALSA: usb-audio: Fix inconsistent card PM state after resume") later moved num_suspended_intf-- into the out: block. The error path now skips both operations, producing an inconsistent power-management state.

Attack Vector

This is a local reliability and denial-of-service condition, not a remote code execution flaw. Triggering the fault requires a USB audio device whose resume callback fails, such as a stalled control transfer during system wake. The failure mode is reachable without third-party code. A malicious or malfunctioning USB audio device could induce the resume error to render audio controls unresponsive.

No verified exploit code is published. See the Linux Kernel Commit 1739a97 for the corrective patch.

Detection Methods for CVE-2026-80828

Indicators of Compromise

Kernel log entries from the USB core reporting an interface resume callback error tied to a snd-usb-audio interface.
User processes stuck in uninterruptible sleep (D state) inside snd_power_ref_and_wait() after a system resume.
ALSA control access (for example, amixer or alsactl) hangs indefinitely after wake from suspend.

Detection Strategies

Monitor dmesg and journal entries for usb_audio_resume errors, -EPIPE, or -EIO returned by USB audio interfaces during resume.
Track kernel task states for processes blocked on ALSA power references following suspend and resume cycles.
Correlate suspend and resume events with subsequent audio subsystem failures to identify affected hosts.

Monitoring Recommendations

Ship kernel logs and process-state telemetry to a centralized logging platform for review after system wake events.
Alert on repeated snd_power_ref_and_wait stack traces in kernel task dumps.
Inventory hosts running vulnerable kernel versions with attached USB audio devices, especially UAC3 devices and Focusrite Scarlett hardware exercising scarlett2_init_notify().

How to Mitigate CVE-2026-80828

Immediate Actions Required

Apply the upstream kernel patch that routes component resume errors through the out: block when system_suspend is nonzero.
Update to a stable kernel release that incorporates the fixes referenced in the kernel.org commits linked below.
On unpatched systems, reboot affected hosts when ALSA control access hangs after resume to restore functionality.

Patch Information

The fix is distributed across multiple stable branch commits. Apply the update relevant to your kernel branch: Linux Kernel Commit 1739a97, Linux Kernel Commit 3f06f3f, Linux Kernel Commit 3fa521c, Linux Kernel Commit 5a625fc, Linux Kernel Commit 6c94877, Linux Kernel Commit 6d3e202, Linux Kernel Commit d1f643b, and Linux Kernel Commit f1c05c4. The patch preserves the existing runtime-resume error path and only alters system-resume error handling.

Workarounds

Disable system suspend on hosts with affected USB audio hardware until the patched kernel is deployed.
Physically disconnect USB audio devices before suspending the system, and reconnect them after resume.
Where feasible, unload the snd-usb-audio module before suspend and reload it after resume.

bash

# Example: unload the ALSA USB audio module before suspend
sudo modprobe -r snd_usb_audio

# Reload after resume to reinitialize interface state
sudo modprobe snd_usb_audio