CVE-2026-98428
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
ALSA: usb: 6fire: Evitar URB incrustadas
El controlador USB 6fire utiliza URB incrustadas en distintas estructuras para PCM, MIDI y comunicación, y hoy en día se trata básicamente de una implementación defectuosa; dado que una URB se gestiona mediante un contador de referencias, esto puede provocar un UAF cuando la URB se libera de forma asíncrona.
Para solucionar el problema, este parche convierte esas URB incrustadas en URB asignadas correctamente mediante usb_alloc_urb(). El pcm_urb.packets[] desaparece, ya que lo asigna usb_alloc_urb(), por lo que ahora se encuentra en urb.iso_frame_desc[].
Leer descripción completaMostrar menos
Las conversiones son bastante sencillas: cada struct urb incrustada se cambia a un puntero, y sus llamadores se actualizan en consecuencia. Los recursos de esas estructuras se liberan en las funciones destructoras comunes (usb6fire_comm_free(), etc.), que se llaman tanto en la ruta de error de inicialización como en la desconexión.
Sin cambios funcionales, solo se ha realizado una compilación de prueba.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 21/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 6 referencias
- https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a
- https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52
- https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81
- https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862
- https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a
- https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98428",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "8b8559aeaba2e51cfee1779b2383b085991f7d81",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "52a43c2d57e774489ac3fbbac06ff02f19bd9a52",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "999f433c09e4668412bd68ca207ae2b4af863862",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "d181434549b3da668110a25d743848cce9897f4e",
"versionType": "git"
},
{
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "9fe49dbc023e82dfaee7b245997d820d01742a9a",
"versionType": "git"
},
{
"status": "affected",
"version": "0",
"lessThan": "6.1.189",
"versionType": "semver"
},
{
"status": "affected",
"version": "0",
"lessThan": "6.6.158",
"versionType": "semver"
},
{
"status": "affected",
"version": "0",
"lessThan": "6.12.112",
"versionType": "semver"
},
{
"status": "affected",
"version": "0",
"lessThan": "6.18.54",
"versionType": "semver"
},
{
"status": "affected",
"version": "0",
"lessThan": "7.2.8",
"versionType": "semver"
}
],
"programFiles": [
"sound/usb/6fire/comm.c",
"sound/usb/6fire/comm.h",
"sound/usb/6fire/midi.c",
"sound/usb/6fire/midi.h",
"sound/usb/6fire/pcm.c",
"sound/usb/6fire/pcm.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"sound/usb/6fire/comm.c",
"sound/usb/6fire/comm.h",
"sound/usb/6fire/midi.c",
"sound/usb/6fire/midi.h",
"sound/usb/6fire/pcm.c",
"sound/usb/6fire/pcm.h"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-14T14:17:54.460",
"references": [
{
"url": "https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb: 6fire: Avoid embedded URBs\n\nThe USB 6fire driver uses URBs embedded in different structs for PCM,\nMIDI and communication, and this is basically a buggy implementation\nnowadays; since a URB is managed with a refcount, this may lead to a\nUAF when the URB is released asynchronously.\n\nFor addressing the problem, this patch converts those embedded URBs to\nones that are properly allocated via usb_alloc_urb(). The\npcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence\nit's found in urb.iso_frame_desc[] instead.\n\nThe conversions are rather straightforward; each embedded struct urb\nis changed to a pointer, and its callers are updated accordingly.\nThe resource for those structs are released in the common destructor\nfunctions (usb6fire_comm_free(), etc), which are called at both the\ninit error path and the disconnect.\n\nNo functional changes, only compile-tested."
}
],
"lastModified": "2026-10-19T10:18:49.430",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}