CVE-2026-74505: ALSA: 6fire: Fix UAF at error handling during probe
In the Linux kernel, the following vulnerability has been resolved:
ALSA: 6fire: Fix UAF at error handling during probe
Although 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot a pending URB before freeing the resources, which may lead to a UAF.
This patch addresses it by doing the almost same cleanup procedure like the normal disconnect phase at the error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the referenced Linux kernel patch that fixes the 6fire driver UAF at error handling during the probe phase by ensuring the pending URB is handled/cleaned up in the probe error path similarly to the normal disconnect phase.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74505?
CVE-2026-74505 has a risk score of 40, indicating a moderate severity level.
How do I fix CVE-2026-74505?
To fix CVE-2026-74505, ensure that your Linux kernel is updated to the latest version that includes the necessary patch.
What does CVE-2026-74505 affect?
CVE-2026-74505 affects the ALSA 6fire driver in the Linux kernel, particularly during error handling in the probe phase.
What is a UAF in the context of CVE-2026-74505?
A UAF, or use-after-free, in CVE-2026-74505 refers to the vulnerability where resources are accessed after being freed, potentially leading to system instability.
What are the potential impacts of CVE-2026-74505?
The potential impacts of CVE-2026-74505 include system crashes and unpredictable behavior due to improper resource management.