CVE-2026-74639 (GCVE-0-2026-74639)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-22 15:32
VLAI
Title
ALSA: us144mkii: re-anchor capture URBs on resubmission
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission capture_urb_complete() resubmits each capture URB without anchoring it: usb_get_urb(urb); ret = usb_submit_urb(urb, GFP_ATOMIC); Anchoring is a property of a submission, not of the URB. The giveback path calls usb_unanchor_urb() before urb->complete(), so an URB resubmitted from its own completion handler is off the anchor. The capture URBs are anchored once, at stream start, so from the first completion onward tascam->capture_anchor is empty. tascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the stop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor) to reap the capture URBs before anything is freed. With the anchor empty those calls return immediately and the URBs stay queued on the host controller. tascam_free_urbs() then returns the capture transfer buffers with usb_free_coherent(), and snd_card_free() releases the snd_card allocation that embeds tascam (card->private_data). The controller completes the queued URBs afterwards, writing device-supplied data into the freed transfer buffer, and capture_urb_complete() dereferences the freed driver object. KASAN on 7.2.0-rc5 (arm64): BUG: KASAN: slab-use-after-free in dummy_timer Write of size 512 at addr ffff000015b62000 __asan_memcpy dummy_timer hrtimer_run_softirq Allocated by task 64: usb_alloc_coherent tascam_alloc_urbs tascam_probe Freed by task 170: usb_free_coherent tascam_free_urbs tascam_disconnect usb_unbind_interface BUG: KASAN: slab-use-after-free in capture_urb_complete Read of size 4 at addr ffff0000170ee878 Freed by task 170: release_card_device snd_card_free tascam_disconnect Restore the usb_anchor_urb() between the reference count bump and the resubmission. That also makes the handler's usb_unanchor_urb() failure arm meaningful again and restores usb_kill_anchored_urbs() as a barrier on the disconnect, suspend and stop-work paths. The anchoring was removed on the premise that the URB is already anchored from the initial submission, which does not hold once the first giveback has run. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6666 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 16f14f55141d4c55c3f321f93c328fff7cd6860a , < 7779249561d14b8a17c0c83783225794e24a587d (git)
Affected: ab1db64912428cdf06a4f9542e16e0575e9ad59f , < a5548ce916594c811bd90ce33d67baa3557a6791 (git)
Affected: 5cff1529a2f9b3461a7f5a6e36a86682fc290534 , < 2615f0fb90df8cf5a96133ca4be74294ed288604 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18.39 , < 6.18.45 (semver)
Affected: 7.1.4 , < 7.1.9 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/usx2y/us144mkii_capture.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7779249561d14b8a17c0c83783225794e24a587d",
              "status": "affected",
              "version": "16f14f55141d4c55c3f321f93c328fff7cd6860a",
              "versionType": "git"
            },
            {
              "lessThan": "a5548ce916594c811bd90ce33d67baa3557a6791",
              "status": "affected",
              "version": "ab1db64912428cdf06a4f9542e16e0575e9ad59f",
              "versionType": "git"
            },
            {
              "lessThan": "2615f0fb90df8cf5a96133ca4be74294ed288604",
              "status": "affected",
              "version": "5cff1529a2f9b3461a7f5a6e36a86682fc290534",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/usx2y/us144mkii_capture.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.18.45",
              "status": "affected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.9",
              "status": "affected",
              "version": "7.1.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.18.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "7.1.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us144mkii: re-anchor capture URBs on resubmission\n\ncapture_urb_complete() resubmits each capture URB without anchoring it:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nAnchoring is a property of a submission, not of the URB.  The giveback\npath calls usb_unanchor_urb() before urb-\u003ecomplete(), so an URB\nresubmitted from its own completion handler is off the anchor.  The\ncapture URBs are anchored once, at stream start, so from the first\ncompletion onward tascam-\u003ecapture_anchor is empty.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the\nstop-work path all call usb_kill_anchored_urbs(\u0026tascam-\u003ecapture_anchor)\nto reap the capture URBs before anything is freed.  With the anchor empty\nthose calls return immediately and the URBs stay queued on the host\ncontroller.\n\ntascam_free_urbs() then returns the capture transfer buffers with\nusb_free_coherent(), and snd_card_free() releases the snd_card\nallocation that embeds tascam (card-\u003eprivate_data).  The controller\ncompletes the queued URBs afterwards, writing device-supplied data into\nthe freed transfer buffer, and capture_urb_complete() dereferences the\nfreed driver object.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n  BUG: KASAN: slab-use-after-free in dummy_timer\n  Write of size 512 at addr ffff000015b62000\n   __asan_memcpy\n   dummy_timer\n   hrtimer_run_softirq\n  Allocated by task 64:\n   usb_alloc_coherent\n   tascam_alloc_urbs\n   tascam_probe\n  Freed by task 170:\n   usb_free_coherent\n   tascam_free_urbs\n   tascam_disconnect\n   usb_unbind_interface\n\n  BUG: KASAN: slab-use-after-free in capture_urb_complete\n  Read of size 4 at addr ffff0000170ee878\n  Freed by task 170:\n   release_card_device\n   snd_card_free\n   tascam_disconnect\n\nRestore the usb_anchor_urb() between the reference count bump and the\nresubmission.  That also makes the handler\u0027s usb_unanchor_urb() failure\narm meaningful again and restores usb_kill_anchored_urbs() as a barrier\non the disconnect, suspend and stop-work paths.\n\nThe anchoring was removed on the premise that the URB is already anchored\nfrom the initial submission, which does not hold once the first giveback\nhas run.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:18.236Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7779249561d14b8a17c0c83783225794e24a587d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5548ce916594c811bd90ce33d67baa3557a6791"
        },
        {
          "url": "https://git.kernel.org/stable/c/2615f0fb90df8cf5a96133ca4be74294ed288604"
        }
      ],
      "title": "ALSA: us144mkii: re-anchor capture URBs on resubmission",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74639",
    "datePublished": "2026-08-22T15:32:18.236Z",
    "dateReserved": "2026-08-15T05:44:03.922Z",
    "dateUpdated": "2026-08-22T15:32:18.236Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74639",
      "date": "2026-10-16",
      "epss": "0.00206",
      "percentile": "0.09967"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/usb/usx2y/us144mkii_capture.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "7779249561d14b8a17c0c83783225794e24a587d",
                    "status": "affected",
                    "version": "16f14f55141d4c55c3f321f93c328fff7cd6860a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a5548ce916594c811bd90ce33d67baa3557a6791",
                    "status": "affected",
                    "version": "ab1db64912428cdf06a4f9542e16e0575e9ad59f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2615f0fb90df8cf5a96133ca4be74294ed288604",
                    "status": "affected",
                    "version": "5cff1529a2f9b3461a7f5a6e36a86682fc290534",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "sound/usb/usx2y/us144mkii_capture.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6.18.45",
                    "status": "affected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.1.9",
                    "status": "affected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us144mkii: re-anchor capture URBs on resubmission\n\ncapture_urb_complete() resubmits each capture URB without anchoring it:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nAnchoring is a property of a submission, not of the URB.  The giveback\npath calls usb_unanchor_urb() before urb-\u003ecomplete(), so an URB\nresubmitted from its own completion handler is off the anchor.  The\ncapture URBs are anchored once, at stream start, so from the first\ncompletion onward tascam-\u003ecapture_anchor is empty.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the\nstop-work path all call usb_kill_anchored_urbs(\u0026tascam-\u003ecapture_anchor)\nto reap the capture URBs before anything is freed.  With the anchor empty\nthose calls return immediately and the URBs stay queued on the host\ncontroller.\n\ntascam_free_urbs() then returns the capture transfer buffers with\nusb_free_coherent(), and snd_card_free() releases the snd_card\nallocation that embeds tascam (card-\u003eprivate_data).  The controller\ncompletes the queued URBs afterwards, writing device-supplied data into\nthe freed transfer buffer, and capture_urb_complete() dereferences the\nfreed driver object.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n  BUG: KASAN: slab-use-after-free in dummy_timer\n  Write of size 512 at addr ffff000015b62000\n   __asan_memcpy\n   dummy_timer\n   hrtimer_run_softirq\n  Allocated by task 64:\n   usb_alloc_coherent\n   tascam_alloc_urbs\n   tascam_probe\n  Freed by task 170:\n   usb_free_coherent\n   tascam_free_urbs\n   tascam_disconnect\n   usb_unbind_interface\n\n  BUG: KASAN: slab-use-after-free in capture_urb_complete\n  Read of size 4 at addr ffff0000170ee878\n  Freed by task 170:\n   release_card_device\n   snd_card_free\n   tascam_disconnect\n\nRestore the usb_anchor_urb() between the reference count bump and the\nresubmission.  That also makes the handler\u0027s usb_unanchor_urb() failure\narm meaningful again and restores usb_kill_anchored_urbs() as a barrier\non the disconnect, suspend and stop-work paths.\n\nThe anchoring was removed on the premise that the URB is already anchored\nfrom the initial submission, which does not hold once the first giveback\nhas run.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: us144mkii: reanclar URBs de captura en la resubmisi\u00f3n\n\ncapture_urb_complete() resomete cada URB de captura sin anclarlo:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nEl anclaje es una propiedad de una submisi\u00f3n, no del URB. La ruta de devoluci\u00f3n llama a usb_unanchor_urb() antes de urb -\u003e complete(), por lo que un URB resometido desde su propio gestor de completado est\u00e1 fuera del anclaje. Los URBs de captura se anclan una vez, al inicio del flujo, por lo que desde la primera completaci\u00f3n en adelante tascam -\u003e capture_anchor est\u00e1 vac\u00edo.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() y la ruta de detenci\u00f3n del trabajo llaman a usb_kill_anchored_urbs(\u0026tascam -\u003e capture_anchor) para recolectar los URBs de captura antes de que se libere algo. Con el anclaje vac\u00edo, esas llamadas regresan inmediatamente y los URBs permanecen en cola en el controlador de host.\n\ntascam_free_urbs() luego devuelve los b\u00faferes de transferencia de captura con usb_free_coherent(), y snd_card_free() libera la asignaci\u00f3n de snd_card que incrusta tascam (card -\u003e private_data). El controlador completa los URBs en cola despu\u00e9s, escribiendo datos suministrados por el dispositivo en el b\u00fafer de transferencia liberado, y capture_urb_complete() desreferencia el objeto de controlador liberado.\n\nKASAN en 7.2.0-rc5 (arm64):\n\n  ERROR: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en dummy_timer\n  Escritura de tama\u00f1o 512 en la direcci\u00f3n ffff000015b62000\n   __asan_memcpy\n   dummy_timer\n   hrtimer_run_softirq\n  Asignado por la tarea 64:\n   usb_alloc_coherent\n   tascam_alloc_urbs\n   tascam_probe\n  Liberado por la tarea 170:\n   usb_free_coherent\n   tascam_free_urbs\n   tascam_disconnect\n   usb_unbind_interface\n\n  ERROR: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en capture_urb_complete\n  Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff0000170ee878\n  Liberado por la tarea 170:\n   release_card_device\n   snd_card_free\n   tascam_disconnect\n\nRestaurar usb_anchor_urb() entre el incremento del contador de referencias y la resubmisi\u00f3n. Eso tambi\u00e9n hace que el brazo de fallo de usb_unanchor_urb() del gestor vuelva a ser significativo y restaura usb_kill_anchored_urbs() como una barrera en las rutas de desconexi\u00f3n, suspensi\u00f3n y detenci\u00f3n del trabajo.\n\nEl anclaje fue eliminado bajo la premisa de que el URB ya est\u00e1 anclado desde la submisi\u00f3n inicial, lo cual no se mantiene una vez que la primera devoluci\u00f3n ha ocurrido.\n\nDescubierto por XBOW, clasificado por Baul Lee \u003cbaul.lee@xbow.com\u003e"
          }
        ],
        "id": "CVE-2026-74639",
        "lastModified": "2026-10-14T13:10:00.187",
        "metrics": {},
        "published": "2026-08-22T16:16:37.143",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2615f0fb90df8cf5a96133ca4be74294ed288604"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7779249561d14b8a17c0c83783225794e24a587d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a5548ce916594c811bd90ce33d67baa3557a6791"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-02T00:43:21+00:00",
      "cve": "CVE-2026-74639",
      "id": "CVE-2026-74639",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: us144mkii: re-anchor capture URBs on resubmission",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74639.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.