UBUNTU-CVE-2026-99271: Use After Free

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prevfbuf on capture buffer release A KASAN slab-use-after-free read was reported in submitaudioouturb() when generating an impulse test signal: BUG: KASAN: slab-use-after-free in createimpulsetestsignal sound/usb/line6/playback.c:76 [inline] BUG: KASAN: slab-use-after-free in submitaudioouturb+0x1848/0x1b20 sound/usb/line6/playback.c:249 Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785 Allocated by task 11: kmemcacheallocnoprof+0x2f0/0x390 mm/slub.c:4144 line6bufferacquire+0x1a1/0x220 sound/usb/line6/pcm.c:158 line6pcmacquire+0xb6/0x230 sound/usb/line6/pcm.c:329 line6startupwork+0x3c/0x50 sound/usb/line6/driver.c:728 Freed by task 7785: kfree+0xf8/0x390 mm/slub.c:6566 line6bufferrelease sound/usb/line6/pcm.c:176 [inline] line6bufferrelease+0xa5/0xf0 sound/usb/line6/pcm.c:170 line6pcmrelease sound/usb/line6/pcm.c:305 [inline] line6pcmrelease+0x5a/0x80 sound/usb/line6/pcm.c:313 sndtoneportmonitorput+0x11b/0x190 sound/usb/line6/toneport.c:183 line6pcm->prevfbuf points into the capture PCM stream buffer (line6pcm->in.buffer), which is updated during audioincallback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side. When all capture streams are closed, line6bufferrelease() frees pstr->buffer with kfree(). However, it does not clear line6pcm->prevfbuf. If playback is subsequently started (e.g. via impulse test signal volume control sndline6impulsevolumeput()), submitaudioouturb() dereferences the stale pointer line6pcm->prevfbuf under in.lock, resulting in a slab-use-after-free read. Clear prevfbuf and prevfsize in line6bufferrelease() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submitaudioouturb().