CVE-2026-90207 is a vulnerability in the Linux kernel ALSA MIDI subsystem where snd_midi_input_event() can be called concurrently with rawmidi substream closure, causing the trigger state to become inconsistent. This results in snd_midi_input_event() potentially accessing freed or NULL pointers, leading to a kernel NULL pointer dereference at virtual address 0x00000000000000b0. The flaw arises from a race condition in snd_rawmidi_input_trigger() and close_substream() sequences. The patch serializes input teardown using RCU techniques, ensuring that midisynth_unsubscribe() clears the input file and cancels pending work, preventing re-triggering of input events after the stream is closed.

Successful exploitation can cause a kernel NULL pointer dereference, leading to a denial of service (kernel crash). The CVSS score of 7.8 indicates high severity with impacts on confidentiality, integrity, and availability. There is no indication of known exploits in the wild.

A fix has been applied to the Linux kernel to serialize input teardown with event_input using RCU, preventing the race condition and kernel NULL pointer dereference. Users should update to the fixed Linux kernel version containing this patch. Since this is not a cloud service, remediation requires applying the vendor's kernel update. Patch status is confirmed by the vendor advisory describing the fix.