-

CVE-2026-64491

ALSA: usx2y: us144mkii: fix work UAF on disconnect

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: us144mkii: fix work UAF on disconnect

tascam_disconnect() cancels capture_work and midi_in_work before
usb_kill_anchored_urbs() kills the capture/MIDI-in URBs.  Those URBs
self-resubmit, and their completion handlers reschedule the work.

A URB that completes in the small window between cancel_work_sync() and
usb_kill_anchored_urbs() therefore re-arms the work after its only
cancel.  Nothing cancels it again before snd_card_free() frees the
card-private tascam structure, so the work handler then runs on freed
memory.

Kill the anchored URBs before cancelling the work; once the work is
cancelled no remaining URB can complete to re-arm it.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version c1bb0c13e430623c26543baae5bb9ae21139db87
Version < c071df05bcda0e47aac581d4b564b2bebcb1ff60
Status affected
Version c1bb0c13e430623c26543baae5bb9ae21139db87
Version < 27161c68d5e78807c9d897db222a775b298d05fd
Status affected
Version c1bb0c13e430623c26543baae5bb9ae21139db87
Version < 147996e7e7c9e8339c0e04f6fa7ccb3e4d448ff7
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.18
Status affected
Version 0
Version < 6.18
Status unaffected
Version <= 6.18.*
Version 6.18.39
Status unaffected
Version <= 7.1.*
Version 7.1.4
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.071
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/c071df05bcda0e47aac581d4b564b2bebcb1ff60
https://git.kernel.org/stable/c/27161c68d5e78807c9d897db222a775b298d05fd
https://git.kernel.org/stable/c/147996e7e7c9e8339c0e04f6fa7ccb3e4d448ff7