CVE-2026-64601
- Source
- https://cve.org/CVERecord?id=CVE-2026-64601
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64601.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64601
- Downstream
- Related
- Published
- 2026-08-06T07:13:53.926Z
- Modified
- 2026-08-10T08:27:08.697889840Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ALSA: us144mkii: captureurbcomplete: redundant usbanchorurb corrupts anchor list on each resubmission
In captureurbcomplete(), usbanchorurb() is called on every completion callback, but the URB is already anchored from the initial submission in tascamtriggerstart(). Each redundant call corrupts the anchor's doubly-linked list and inflates the URB refcount. When usbkillanchored_urbs() traverses the list during stream stop / suspend / disconnect, the corrupted list leads to use-after-free.
Remove the redundant usbanchorurb() from the resubmit path.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64601.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/16f14f55141d4c55c3f321f93c328fff7cd6860a
- https://git.kernel.org/stable/c/5cff1529a2f9b3461a7f5a6e36a86682fc290534
- https://git.kernel.org/stable/c/ab1db64912428cdf06a4f9542e16e0575e9ad59f
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64601.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-64601
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git