The Linux kernel ALSA bcd2000 driver had a vulnerability where the function bcd2000_free_usb_related_resources() freed USB Request Blocks (URBs) but left their pointers intact. This allowed a substream still open during device unplug to call bcd2000_midi_send(), which writes to and submits these freed URBs, causing use-after-free conditions. The kernel's usb_kill_urb() does not prevent resubmission of URBs, enabling a race condition where freed URBs are requeued. The fix clears URB pointers after freeing and uses usb_poison_urb() to wait for completion handlers and reject further submissions, preventing use-after-free.

The vulnerability can cause use-after-free memory corruption in the ALSA bcd2000 driver, potentially leading to kernel crashes or undefined behavior when a USB audio device is disconnected while a MIDI substream remains open. No known exploits in the wild have been reported.

A fix is available that clears URB pointers after freeing and poisons URBs to prevent further submissions. Users should update to a Linux kernel version that includes this fix. No additional mitigation is required beyond applying the official patch.