CVE-2026-98428: ALSA: usb: 6fire: Avoid embedded URBs
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb: 6fire: Avoid embedded URBs
The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously.
For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usballocurb(). The pcmurb.packets[] is gone, as it's allocated by usballocurb(), hence it's found in urb.isoframedesc[] instead.
The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6firecommfree(), etc), which are called at both the init error path and the disconnect.
No functional changes, only compile-tested.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the ALSA USB 6fire driver are the relevant population. The issue concerns the driver's handling of USB request blocks for PCM, MIDI, and communication functions.
What condition can trigger the use-after-free?
The risk arises when a URB embedded in the driver's structures is released asynchronously while its reference-counted lifetime is still being managed. This can lead to use-after-free behavior in the USB 6fire driver.
What does the fix change?
The fix replaces embedded URBs with URBs allocated through usb_alloc_urb() and releases them through the driver's common destructor functions during initialization-error handling and device disconnect.