7.8

CVE-2026-64601

ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

In the Linux kernel, the following vulnerability has been resolved:

ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

In capture_urb_complete(), usb_anchor_urb() is called on every
completion callback, but the URB is already anchored from the
initial submission in tascam_trigger_start(). Each redundant call
corrupts the anchor's doubly-linked list and inflates the URB
refcount. When usb_kill_anchored_urbs() traverses the list during
stream stop / suspend / disconnect, the corrupted list leads to
use-after-free.

Remove the redundant usb_anchor_urb() from the resubmit path.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version c1bb0c13e430623c26543baae5bb9ae21139db87
Version < 16f14f55141d4c55c3f321f93c328fff7cd6860a
Status affected
Version c1bb0c13e430623c26543baae5bb9ae21139db87
Version < ab1db64912428cdf06a4f9542e16e0575e9ad59f
Status affected
Version c1bb0c13e430623c26543baae5bb9ae21139db87
Version < 5cff1529a2f9b3461a7f5a6e36a86682fc290534
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.18
Status affected
Version 0
Version < 6.18
Status unaffected
Version <= 6.18.*
Version 6.18.39
Status unaffected
Version <= 7.1.*
Version 7.1.4
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.025
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/16f14f55141d4c55c3f321f93c328fff7cd6860a
https://git.kernel.org/stable/c/ab1db64912428cdf06a4f9542e16e0575e9ad59f
https://git.kernel.org/stable/c/5cff1529a2f9b3461a7f5a6e36a86682fc290534