Riskcovery

CVE-2026-64601

ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

State
Published
Severity
7.8 High
Published
Aug 6, 2026
Updated
Aug 17, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

In capture_urb_complete(), usb_anchor_urb() is called on every completion callback, but the URB is already anchored from the initial submission in tascam_trigger_start(). Each redundant call corrupts the anchor's doubly-linked list and inflates the URB refcount. When usb_kill_anchored_urbs() traverses the list during stream stop / suspend / disconnect, the corrupted list leads to use-after-free.

Remove the redundant usb_anchor_urb() from the resubmit path.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c1bb0c13e430623c26543baae5bb9ae21139db87 to before 16f14f55141d4c55c3f321f93c328fff7cd6860aAffected
  • c1bb0c13e430623c26543baae5bb9ae21139db87 to before ab1db64912428cdf06a4f9542e16e0575e9ad59fAffected
  • c1bb0c13e430623c26543baae5bb9ae21139db87 to before 5cff1529a2f9b3461a7f5a6e36a86682fc290534Affected
LinuxLinux
  • 6.18Affected
  • before 6.18Not affected
  • 6.18.39 through 6.18.*Not affected
  • 7.1.4 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.