CVE-2026-64491: ALSA: usx2y: us144mkii: fix work UAF on disconnect
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usx2y: us144mkii: fix work UAF on disconnect
tascamdisconnect() cancels capturework and midiinwork before usbkillanchoredurbs() kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule the work.
A URB that completes in the small window between cancelworksync() and usbkillanchoredurbs() therefore re-arms the work after its only cancel. Nothing cancels it again before sndcardfree() frees the card-private tascam structure, so the work handler then runs on freed memory.
Kill the anchored URBs before cancelling the work; once the work is cancelled no remaining URB can complete to re-arm it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64491?
CVE-2026-64491 has a risk rating of 44.
How do I fix CVE-2026-64491?
To fix CVE-2026-64491, ensure that your Linux kernel version is updated to the latest patch that addresses the vulnerability.
What systems are affected by CVE-2026-64491?
CVE-2026-64491 affects Linux kernel versions that utilize the ALSA usx2y driver.
What type of vulnerability is CVE-2026-64491?
CVE-2026-64491 is classified as a use-after-free (UAF) vulnerability.
What impact does CVE-2026-64491 have on system security?
CVE-2026-64491 could potentially allow an attacker to execute arbitrary code or disrupt system processes.