CVE-2026-74639

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74639", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.922Z", "datePublished": "2026-08-22T15:32:18.236Z", "dateUpdated": "2026-08-22T15:32:18.236Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-22T15:32:18.236Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us144mkii: re-anchor capture URBs on resubmission\n\ncapture_urb_complete() resubmits each capture URB without anchoring it:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nAnchoring is a property of a submission, not of the URB. The giveback\npath calls usb_unanchor_urb() before urb->complete(), so an URB\nresubmitted from its own completion handler is off the anchor. The\ncapture URBs are anchored once, at stream start, so from the first\ncompletion onward tascam->capture_anchor is empty.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the\nstop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor)\nto reap the capture URBs before anything is freed. With the anchor empty\nthose calls return immediately and the URBs stay queued on the host\ncontroller.\n\ntascam_free_urbs() then returns the capture transfer buffers with\nusb_free_coherent(), and snd_card_free() releases the snd_card\nallocation that embeds tascam (card->private_data). The controller\ncompletes the queued URBs afterwards, writing device-supplied data into\nthe freed transfer buffer, and capture_urb_complete() dereferences the\nfreed driver object.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n BUG: KASAN: slab-use-after-free in dummy_timer\n Write of size 512 at addr ffff000015b62000\n __asan_memcpy\n dummy_timer\n hrtimer_run_softirq\n Allocated by task 64:\n usb_alloc_coherent\n tascam_alloc_urbs\n tascam_probe\n Freed by task 170:\n usb_free_coherent\n tascam_free_urbs\n tascam_disconnect\n usb_unbind_interface\n\n BUG: KASAN: slab-use-after-free in capture_urb_complete\n Read of size 4 at addr ffff0000170ee878\n Freed by task 170:\n release_card_device\n snd_card_free\n tascam_disconnect\n\nRestore the usb_anchor_urb() between the reference count bump and the\nresubmission. That also makes the handler's usb_unanchor_urb() failure\narm meaningful again and restores usb_kill_anchored_urbs() as a barrier\non the disconnect, suspend and stop-work paths.\n\nThe anchoring was removed on the premise that the URB is already anchored\nfrom the initial submission, which does not hold once the first giveback\nhas run.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/usx2y/us144mkii_capture.c"], "versions": [{"version": "16f14f55141d4c55c3f321f93c328fff7cd6860a", "lessThan": "7779249561d14b8a17c0c83783225794e24a587d", "status": "affected", "versionType": "git"}, {"version": "ab1db64912428cdf06a4f9542e16e0575e9ad59f", "lessThan": "a5548ce916594c811bd90ce33d67baa3557a6791", "status": "affected", "versionType": "git"}, {"version": "5cff1529a2f9b3461a7f5a6e36a86682fc290534", "lessThan": "2615f0fb90df8cf5a96133ca4be74294ed288604", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/usx2y/us144mkii_capture.c"], "versions": [{"version": "6.18.39", "lessThan": "6.18.45", "status": "affected", "versionType": "semver"}, {"version": "7.1.4", "lessThan": "7.1.9", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.39", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.4", "versionEndExcluding": "7.1.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7779249561d14b8a17c0c83783225794e24a587d"}, {"url": "https://git.kernel.org/stable/c/a5548ce916594c811bd90ce33d67baa3557a6791"}, {"url": "https://git.kernel.org/stable/c/2615f0fb90df8cf5a96133ca4be74294ed288604"}], "title": "ALSA: us144mkii: re-anchor capture URBs on resubmission", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/usx2y/us144mkii_capture.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7779249561d14b8a17c0c83783225794e24a587d", "status": "affected", "version": "16f14f55141d4c55c3f321f93c328fff7cd6860a", "versionType": "git"}, {"lessThan": "a5548ce916594c811bd90ce33d67baa3557a6791", "status": "affected", "version": "ab1db64912428cdf06a4f9542e16e0575e9ad59f", "versionType": "git"}, {"lessThan": "2615f0fb90df8cf5a96133ca4be74294ed288604", "status": "affected", "version": "5cff1529a2f9b3461a7f5a6e36a86682fc290534", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/usx2y/us144mkii_capture.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.18.45", "status": "affected", "version": "6.18.39", "versionType": "semver"}, {"lessThan": "7.1.9", "status": "affected", "version": "7.1.4", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us144mkii: re-anchor capture URBs on resubmission\n\ncapture_urb_complete() resubmits each capture URB without anchoring it:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nAnchoring is a property of a submission, not of the URB. The giveback\npath calls usb_unanchor_urb() before urb->complete(), so an URB\nresubmitted from its own completion handler is off the anchor. The\ncapture URBs are anchored once, at stream start, so from the first\ncompletion onward tascam->capture_anchor is empty.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the\nstop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor)\nto reap the capture URBs before anything is freed. With the anchor empty\nthose calls return immediately and the URBs stay queued on the host\ncontroller.\n\ntascam_free_urbs() then returns the capture transfer buffers with\nusb_free_coherent(), and snd_card_free() releases the snd_card\nallocation that embeds tascam (card->private_data). The controller\ncompletes the queued URBs afterwards, writing device-supplied data into\nthe freed transfer buffer, and capture_urb_complete() dereferences the\nfreed driver object.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n BUG: KASAN: slab-use-after-free in dummy_timer\n Write of size 512 at addr ffff000015b62000\n __asan_memcpy\n dummy_timer\n hrtimer_run_softirq\n Allocated by task 64:\n usb_alloc_coherent\n tascam_alloc_urbs\n tascam_probe\n Freed by task 170:\n usb_free_coherent\n tascam_free_urbs\n tascam_disconnect\n usb_unbind_interface\n\n BUG: KASAN: slab-use-after-free in capture_urb_complete\n Read of size 4 at addr ffff0000170ee878\n Freed by task 170:\n release_card_device\n snd_card_free\n tascam_disconnect\n\nRestore the usb_anchor_urb() between the reference count bump and the\nresubmission. That also makes the handler's usb_unanchor_urb() failure\narm meaningful again and restores usb_kill_anchored_urbs() as a barrier\non the disconnect, suspend and stop-work paths.\n\nThe anchoring was removed on the premise that the URB is already anchored\nfrom the initial submission, which does not hold once the first giveback\nhas run.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: us144mkii: reanclar URBs de captura en la resubmisi\u00f3n\n\ncapture_urb_complete() resomete cada URB de captura sin anclarlo:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nEl anclaje es una propiedad de una submisi\u00f3n, no del URB. La ruta de devoluci\u00f3n llama a usb_unanchor_urb() antes de urb -> complete(), por lo que un URB resometido desde su propio gestor de completado est\u00e1 fuera del anclaje. Los URBs de captura se anclan una vez, al inicio del flujo, por lo que desde la primera completaci\u00f3n en adelante tascam -> capture_anchor est\u00e1 vac\u00edo.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() y la ruta de detenci\u00f3n del trabajo llaman a usb_kill_anchored_urbs(&tascam -> capture_anchor) para recolectar los URBs de captura antes de que se libere algo. Con el anclaje vac\u00edo, esas llamadas regresan inmediatamente y los URBs permanecen en cola en el controlador de host.\n\ntascam_free_urbs() luego devuelve los b\u00faferes de transferencia de captura con usb_free_coherent(), y snd_card_free() libera la asignaci\u00f3n de snd_card que incrusta tascam (card -> private_data). El controlador completa los URBs en cola despu\u00e9s, escribiendo datos suministrados por el dispositivo en el b\u00fafer de transferencia liberado, y capture_urb_complete() desreferencia el objeto de controlador liberado.\n\nKASAN en 7.2.0-rc5 (arm64):\n\n ERROR: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en dummy_timer\n Escritura de tama\u00f1o 512 en la direcci\u00f3n ffff000015b62000\n __asan_memcpy\n dummy_timer\n hrtimer_run_softirq\n Asignado por la tarea 64:\n usb_alloc_coherent\n tascam_alloc_urbs\n tascam_probe\n Liberado por la tarea 170:\n usb_free_coherent\n tascam_free_urbs\n tascam_disconnect\n usb_unbind_interface\n\n ERROR: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en capture_urb_complete\n Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff0000170ee878\n Liberado por la tarea 170:\n release_card_device\n snd_card_free\n tascam_disconnect\n\nRestaurar usb_anchor_urb() entre el incremento del contador de referencias y la resubmisi\u00f3n. Eso tambi\u00e9n hace que el brazo de fallo de usb_unanchor_urb() del gestor vuelva a ser significativo y restaura usb_kill_anchored_urbs() como una barrera en las rutas de desconexi\u00f3n, suspensi\u00f3n y detenci\u00f3n del trabajo.\n\nEl anclaje fue eliminado bajo la premisa de que el URB ya est\u00e1 anclado desde la submisi\u00f3n inicial, lo cual no se mantiene una vez que la primera devoluci\u00f3n ha ocurrido.\n\nDescubierto por XBOW, clasificado por Baul Lee <baul.lee@xbow.com>"}], "id": "CVE-2026-74639", "lastModified": "2026-10-14T13:10:00.187", "metrics": {}, "published": "2026-08-22T16:16:37.143", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2615f0fb90df8cf5a96133ca4be74294ed288604"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7779249561d14b8a17c0c83783225794e24a587d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a5548ce916594c811bd90ce33d67baa3557a6791"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: us144mkii: re-anchor capture URBs on resubmission", "id": "2521467", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521467"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: us144mkii: re-anchor capture URBs on resubmission\ncapture_urb_complete() resubmits each capture URB without anchoring it:\nusb_get_urb(urb);\nret = usb_submit_urb(urb, GFP_ATOMIC);\nAnchoring is a property of a submission, not of the URB. The giveback\npath calls usb_unanchor_urb() before urb->complete(), so an URB\nresubmitted from its own completion handler is off the anchor. The\ncapture URBs are anchored once, at stream start, so from the first\ncompletion onward tascam->capture_anchor is empty.\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the\nstop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor)\nto reap the capture URBs before anything is freed. With the anchor empty\nthose calls return immediately and the URBs stay queued on the host\ncontroller.\ntascam_free_urbs() then returns the capture transfer buffers with\nusb_free_coherent(), and snd_card_free() releases the snd_card\nallocation that embeds tascam (card->private_data). The controller\ncompletes the queued URBs afterwards, writing device-supplied data into\nthe freed transfer buffer, and capture_urb_complete() dereferences the\nfreed driver object.\nKASAN on 7.2.0-rc5 (arm64):\nBUG: KASAN: slab-use-after-free in dummy_timer\nWrite of size 512 at addr ffff000015b62000\n__asan_memcpy\ndummy_timer\nhrtimer_run_softirq\nAllocated by task 64:\nusb_alloc_coherent\ntascam_alloc_urbs\ntascam_probe\nFreed by task 170:\nusb_free_coherent\ntascam_free_urbs\ntascam_disconnect\nusb_unbind_interface\nBUG: KASAN: slab-use-after-free in capture_urb_complete\nRead of size 4 at addr ffff0000170ee878\nFreed by task 170:\nrelease_card_device\nsnd_card_free\ntascam_disconnect\nRestore the usb_anchor_urb() between the reference count bump and the\nresubmission. That also makes the handler's usb_unanchor_urb() failure\narm meaningful again and restores usb_kill_anchored_urbs() as a barrier\non the disconnect, suspend and stop-work paths.\nThe anchoring was removed on the premise that the URB is already anchored\nfrom the initial submission, which does not hold once the first giveback\nhas run.\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>", "A flaw was found in the Linux kernel, specifically within the ALSA `us144mkii` driver. The `capture_urb_complete()` function resubmits capture Urban Request Blocks (URBs) without properly re-anchoring them. This oversight allows URBs to remain queued on the host controller even after their associated memory has been freed. A local attacker could exploit this use-after-free vulnerability by manipulating device-supplied data, potentially leading to arbitrary code execution or a denial of service."], "name": "CVE-2026-74639", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74639\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74639\nhttps://lore.kernel.org/linux-cve-announce/2026082223-CVE-2026-74639-61eb@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[16f14f55141d4c55c3f321f93c328fff7cd6860a,7779249561d14b8a17c0c83783225794e24a587d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ab1db64912428cdf06a4f9542e16e0575e9ad59f,a5548ce916594c811bd90ce33d67baa3557a6791)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5cff1529a2f9b3461a7f5a6e36a86682fc290534,2615f0fb90df8cf5a96133ca4be74294ed288604)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.39,6.18.45)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.4,7.1.9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "kernel", "vendor": "linux"}], "created": "2026-08-22T18:00:04.734252+00:00", "updated": "2026-08-25T13:45:04.365068+00:00", "vendors": ["linux", "linux$PRODUCT$kernel"], "weaknesses": ["CWE-416", "CWE-825"]}