CVE-2026-98428

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98428", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.348Z", "datePublished": "2026-10-14T13:27:54.364Z", "dateUpdated": "2026-10-26T06:55:43.958Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-26T06:55:43.958Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb: 6fire: Avoid embedded URBs\n\nThe USB 6fire driver uses URBs embedded in different structs for PCM,\nMIDI and communication, and this is basically a buggy implementation\nnowadays; since a URB is managed with a refcount, this may lead to a\nUAF when the URB is released asynchronously.\n\nFor addressing the problem, this patch converts those embedded URBs to\nones that are properly allocated via usb_alloc_urb(). The\npcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence\nit's found in urb.iso_frame_desc[] instead.\n\nThe conversions are rather straightforward; each embedded struct urb\nis changed to a pointer, and its callers are updated accordingly.\nThe resource for those structs are released in the common destructor\nfunctions (usb6fire_comm_free(), etc), which are called at both the\ninit error path and the disconnect.\n\nNo functional changes, only compile-tested."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/6fire/comm.c", "sound/usb/6fire/comm.h", "sound/usb/6fire/midi.c", "sound/usb/6fire/midi.h", "sound/usb/6fire/pcm.c", "sound/usb/6fire/pcm.h"], "versions": [{"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "8b8559aeaba2e51cfee1779b2383b085991f7d81", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "52a43c2d57e774489ac3fbbac06ff02f19bd9a52", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "999f433c09e4668412bd68ca207ae2b4af863862", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "d181434549b3da668110a25d743848cce9897f4e", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "9fe49dbc023e82dfaee7b245997d820d01742a9a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/6fire/comm.c", "sound/usb/6fire/comm.h", "sound/usb/6fire/midi.c", "sound/usb/6fire/midi.h", "sound/usb/6fire/pcm.c", "sound/usb/6fire/pcm.h"], "versions": [{"version": "2.6.39", "status": "affected"}, {"version": "0", "lessThan": "2.6.39", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a"}, {"url": "https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81"}, {"url": "https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52"}, {"url": "https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862"}, {"url": "https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e"}, {"url": "https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a"}], "title": "ALSA: usb: 6fire: Avoid embedded URBs", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/6fire/comm.c", "sound/usb/6fire/comm.h", "sound/usb/6fire/midi.c", "sound/usb/6fire/midi.h", "sound/usb/6fire/pcm.c", "sound/usb/6fire/pcm.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "8b8559aeaba2e51cfee1779b2383b085991f7d81", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "52a43c2d57e774489ac3fbbac06ff02f19bd9a52", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "999f433c09e4668412bd68ca207ae2b4af863862", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "d181434549b3da668110a25d743848cce9897f4e", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "9fe49dbc023e82dfaee7b245997d820d01742a9a", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/6fire/comm.c", "sound/usb/6fire/comm.h", "sound/usb/6fire/midi.c", "sound/usb/6fire/midi.h", "sound/usb/6fire/pcm.c", "sound/usb/6fire/pcm.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.39"}, {"lessThan": "2.6.39", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb: 6fire: Avoid embedded URBs\n\nThe USB 6fire driver uses URBs embedded in different structs for PCM,\nMIDI and communication, and this is basically a buggy implementation\nnowadays; since a URB is managed with a refcount, this may lead to a\nUAF when the URB is released asynchronously.\n\nFor addressing the problem, this patch converts those embedded URBs to\nones that are properly allocated via usb_alloc_urb(). The\npcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence\nit's found in urb.iso_frame_desc[] instead.\n\nThe conversions are rather straightforward; each embedded struct urb\nis changed to a pointer, and its callers are updated accordingly.\nThe resource for those structs are released in the common destructor\nfunctions (usb6fire_comm_free(), etc), which are called at both the\ninit error path and the disconnect.\n\nNo functional changes, only compile-tested."}], "id": "CVE-2026-98428", "lastModified": "2026-10-26T07:17:10.737", "metrics": {}, "published": "2026-10-14T14:17:54.460", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: usb: 6fire: Avoid embedded URBs", "id": "2552190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552190"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: usb: 6fire: Avoid embedded URBs\nThe USB 6fire driver uses URBs embedded in different structs for PCM,\nMIDI and communication, and this is basically a buggy implementation\nnowadays; since a URB is managed with a refcount, this may lead to a\nUAF when the URB is released asynchronously.\nFor addressing the problem, this patch converts those embedded URBs to\nones that are properly allocated via usb_alloc_urb(). The\npcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence\nit's found in urb.iso_frame_desc[] instead.\nThe conversions are rather straightforward; each embedded struct urb\nis changed to a pointer, and its callers are updated accordingly.\nThe resource for those structs are released in the common destructor\nfunctions (usb6fire_comm_free(), etc), which are called at both the\ninit error path and the disconnect.\nNo functional changes, only compile-tested.", "A flaw was found in the Linux kernel's ALSA USB 6fire audio driver. The driver improperly embeds USB Request Blocks (URBs)\u2014structures that manage USB communications\u2014directly inside driver objects rather than allocating them dynamically. Because URBs rely on reference counting and can be released asynchronously, this design can cause memory to be accessed after it has been freed. A local attacker could exploit this flaw to cause a Denial of Service (DoS) via a system crash or potentially execute arbitrary code."], "name": "CVE-2026-98428", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98428\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98428\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98428.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8b8559aeaba2e51cfee1779b2383b085991f7d81)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,52a43c2d57e774489ac3fbbac06ff02f19bd9a52)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,999f433c09e4668412bd68ca207ae2b4af863862)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d181434549b3da668110a25d743848cce9897f4e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9fe49dbc023e82dfaee7b245997d820d01742a9a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.1.189)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.158)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.112)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.54)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-15T05:15:14.983678+00:00", "updated": "2026-10-20T03:00:16.307841+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}