CVE-2026-74639

In the Linux kernel, the following vulnerability has been resolved:

ALSA: us144mkii: re-anchor capture URBs on resubmission

captureurbcomplete() resubmits each capture URB without anchoring it:

usb_get_urb(urb);
ret = usb_submit_urb(urb, GFP_ATOMIC);

Anchoring is a property of a submission, not of the URB. The giveback path calls usbunanchorurb() before urb->complete(), so an URB resubmitted from its own completion handler is off the anchor. The capture URBs are anchored once, at stream start, so from the first completion onward tascam->capture_anchor is empty.

tascamfreeurbs(), tascamdisconnect(), tascamsuspend() and the stop-work path all call usbkillanchoredurbs(&tascam->captureanchor) to reap the capture URBs before anything is freed. With the anchor empty those calls return immediately and the URBs stay queued on the host controller.

tascamfreeurbs() then returns the capture transfer buffers with usbfreecoherent(), and sndcardfree() releases the sndcard allocation that embeds tascam (card->privatedata). The controller completes the queued URBs afterwards, writing device-supplied data into the freed transfer buffer, and captureurbcomplete() dereferences the freed driver object.

KASAN on 7.2.0-rc5 (arm64):

BUG: KASAN: slab-use-after-free in dummy_timer Write of size 512 at addr ffff000015b62000 __asanmemcpy dummytimer hrtimerrunsoftirq Allocated by task 64: usballoccoherent tascamallocurbs tascamprobe Freed by task 170: usbfreecoherent tascamfreeurbs tascamdisconnect usbunbindinterface

BUG: KASAN: slab-use-after-free in captureurbcomplete Read of size 4 at addr ffff0000170ee878 Freed by task 170: releasecarddevice sndcardfree tascam_disconnect

Restore the usbanchorurb() between the reference count bump and the resubmission. That also makes the handler's usbunanchorurb() failure arm meaningful again and restores usbkillanchored_urbs() as a barrier on the disconnect, suspend and stop-work paths.

The anchoring was removed on the premise that the URB is already anchored from the initial submission, which does not hold once the first giveback has run.

Discovered by XBOW, triaged by Baul Lee baul.lee@xbow.com