A race condition vulnerability in the Linux kernel ALSA MIDI subsystem, identified as CVE-2026-90207, may allow a local attacker to cause a kernel crash or gain elevated privileges.

This flaw exists due to improper serialization between the ALSA sequencer MIDI input teardown and the event_input function. An authenticated local user can trigger a race condition during the closing of a rawmidi substream, leading to a NULL pointer dereference and kernel panic.

Successful exploitation allows a local user to crash the system, leading to significant denial of service. Given the CVSS score of 7.8, the ability to potentially execute arbitrary code or gain elevated privileges from a local context poses a severe risk to system integrity and data confidentiality.

Immediate Action: Update the Linux kernel to version 6.1.188, 6.6.157, 6.12.110, 6.18.52, or any subsequent stable release provided by your distribution.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or unexpected reboots, particularly those involving the ALSA or rawmidi subsystems.

Compensating Controls: Restrict access to local system resources and hardware interfaces to untrusted users to minimize the attack surface for local privilege escalation vectors.

Public Exploit Available: Unknown.

While this vulnerability requires local access, the potential for kernel-level impact warrants immediate attention. Organizations should prioritize patching their Linux environments by applying the latest kernel updates provided by their respective distributions to eliminate the underlying race condition and maintain system stability.