CVE-2026-74639
In the Linux kernel, the following vulnerability has been resolved:
ALSA: us144mkii: re-anchor capture URBs on resubmission
capture_urb_complete() resubmits each capture URB without anchoring it:
Anchoring is a property of a submission, not of the URB. The giveback path calls usb_unanchor_urb() before urb->complete(), so an URB resubmitted from its own completion handler is off the anchor. The capture URBs are anchored once, at stream start, so from the first completion onward tascam->capture_anchor is empty.
tascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the stop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor) to reap the capture URBs before anything is freed.
Leer descripción completaMostrar menos
With the anchor empty those calls return immediately and the URBs stay queued on the host controller.
tascam_free_urbs() then returns the capture transfer buffers with usb_free_coherent(), and snd_card_free() releases the snd_card allocation that embeds tascam (card->private_data). The controller completes the queued URBs afterwards, writing device-supplied data into the freed transfer buffer, and capture_urb_complete() dereferences the freed driver object.
Restore the usb_anchor_urb() between the reference count bump and the resubmission. That also makes the handler's usb_unanchor_urb() failure arm meaningful again and restores usb_kill_anchored_urbs() as a barrier on the disconnect, suspend and stop-work paths.
The anchoring was removed on the premise that the URB is already anchored from the initial submission, which does not hold once the first giveback has run.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Detalles técnicos trazas, registros y código del informe original
usb_get_urb(urb); ret = usb_submit_urb(urb, GFP_ATOMIC); KASAN on 7.2.0-rc5 (arm64): BUG: KASAN: slab-use-after-free in dummy_timer Write of size 512 at addr ffff000015b62000 __asan_memcpy dummy_timer hrtimer_run_softirq Allocated by task 64: usb_alloc_coherent tascam_alloc_urbs tascam_probe Freed by task 170: usb_free_coherent tascam_free_urbs tascam_disconnect usb_unbind_interface BUG: KASAN: slab-use-after-free in capture_urb_complete Read of size 4 at addr ffff0000170ee878 Freed by task 170: release_card_device snd_card_free tascam_disconnect
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-74639",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "16f14f55141d4c55c3f321f93c328fff7cd6860a",
"lessThan": "7779249561d14b8a17c0c83783225794e24a587d",
"versionType": "git"
},
{
"status": "affected",
"version": "ab1db64912428cdf06a4f9542e16e0575e9ad59f",
"lessThan": "a5548ce916594c811bd90ce33d67baa3557a6791",
"versionType": "git"
},
{
"status": "affected",
"version": "5cff1529a2f9b3461a7f5a6e36a86682fc290534",
"lessThan": "2615f0fb90df8cf5a96133ca4be74294ed288604",
"versionType": "git"
}
],
"programFiles": [
"sound/usb/usx2y/us144mkii_capture.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18.39",
"lessThan": "6.18.45",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.1.4",
"lessThan": "7.1.9",
"versionType": "semver"
}
],
"programFiles": [
"sound/usb/usx2y/us144mkii_capture.c"
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-08-22T16:16:37.143",
"references": [
{
"url": "https://git.kernel.org/stable/c/2615f0fb90df8cf5a96133ca4be74294ed288604",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7779249561d14b8a17c0c83783225794e24a587d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a5548ce916594c811bd90ce33d67baa3557a6791",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us144mkii: re-anchor capture URBs on resubmission\n\ncapture_urb_complete() resubmits each capture URB without anchoring it:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nAnchoring is a property of a submission, not of the URB. The giveback\npath calls usb_unanchor_urb() before urb->complete(), so an URB\nresubmitted from its own completion handler is off the anchor. The\ncapture URBs are anchored once, at stream start, so from the first\ncompletion onward tascam->capture_anchor is empty.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the\nstop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor)\nto reap the capture URBs before anything is freed. With the anchor empty\nthose calls return immediately and the URBs stay queued on the host\ncontroller.\n\ntascam_free_urbs() then returns the capture transfer buffers with\nusb_free_coherent(), and snd_card_free() releases the snd_card\nallocation that embeds tascam (card->private_data). The controller\ncompletes the queued URBs afterwards, writing device-supplied data into\nthe freed transfer buffer, and capture_urb_complete() dereferences the\nfreed driver object.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n BUG: KASAN: slab-use-after-free in dummy_timer\n Write of size 512 at addr ffff000015b62000\n __asan_memcpy\n dummy_timer\n hrtimer_run_softirq\n Allocated by task 64:\n usb_alloc_coherent\n tascam_alloc_urbs\n tascam_probe\n Freed by task 170:\n usb_free_coherent\n tascam_free_urbs\n tascam_disconnect\n usb_unbind_interface\n\n BUG: KASAN: slab-use-after-free in capture_urb_complete\n Read of size 4 at addr ffff0000170ee878\n Freed by task 170:\n release_card_device\n snd_card_free\n tascam_disconnect\n\nRestore the usb_anchor_urb() between the reference count bump and the\nresubmission. That also makes the handler's usb_unanchor_urb() failure\narm meaningful again and restores usb_kill_anchored_urbs() as a barrier\non the disconnect, suspend and stop-work paths.\n\nThe anchoring was removed on the premise that the URB is already anchored\nfrom the initial submission, which does not hold once the first giveback\nhas run.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"
}
],
"lastModified": "2026-08-22T16:16:37.143",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}