CVE-2026-99271

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99271", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.404Z", "datePublished": "2026-11-07T14:08:45.047Z", "dateUpdated": "2026-11-10T18:15:27.042Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:27.042Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: Clear prev_fbuf on capture buffer release\n\nA KASAN slab-use-after-free read was reported in submit_audio_out_urb()\nwhen generating an impulse test signal:\n\n BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]\n BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249\n Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785\n\n Allocated by task 11:\n kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144\n line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158\n line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329\n line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728\n\n Freed by task 7785:\n kfree+0xf8/0x390 mm/slub.c:6566\n line6_buffer_release sound/usb/line6/pcm.c:176 [inline]\n line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170\n __line6_pcm_release sound/usb/line6/pcm.c:305 [inline]\n line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313\n snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183\n\nline6pcm->prev_fbuf points into the capture PCM stream buffer\n(line6pcm->in.buffer), which is updated during audio_in_callback() to\nfeed rate synchronization, software monitoring, and impulse test signal\ngeneration on playback side.\n\nWhen all capture streams are closed, line6_buffer_release() frees\npstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf.\nIf playback is subsequently started (e.g. via impulse test signal\nvolume control snd_line6_impulse_volume_put()), submit_audio_out_urb()\ndereferences the stale pointer line6pcm->prev_fbuf under in.lock,\nresulting in a slab-use-after-free read.\n\nClear prev_fbuf and prev_fsize in line6_buffer_release() when releasing\nthe capture stream buffer under in.lock, ensuring that no stale buffer\npointer can be accessed by submit_audio_out_urb()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/line6/pcm.c"], "versions": [{"version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74", "lessThan": "d063975ed22cdc2cb609a9828e5f658448193606", "status": "affected", "versionType": "git"}, {"version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74", "lessThan": "862d9268f40a6e10cef24eb226e738fb69ce8aa7", "status": "affected", "versionType": "git"}, {"version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74", "lessThan": "22c82f33ff0b68d37041adf1dea5533a5863cd31", "status": "affected", "versionType": "git"}, {"version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74", "lessThan": "aa118c8f61d59387961d58ffae831c5259a9f222", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/line6/pcm.c"], "versions": [{"version": "4.0", "status": "affected"}, {"version": "0", "lessThan": "4.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.61", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "6.18.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d063975ed22cdc2cb609a9828e5f658448193606"}, {"url": "https://git.kernel.org/stable/c/862d9268f40a6e10cef24eb226e738fb69ce8aa7"}, {"url": "https://git.kernel.org/stable/c/22c82f33ff0b68d37041adf1dea5533a5863cd31"}, {"url": "https://git.kernel.org/stable/c/aa118c8f61d59387961d58ffae831c5259a9f222"}], "title": "ALSA: line6: Clear prev_fbuf on capture buffer release", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/line6/pcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d063975ed22cdc2cb609a9828e5f658448193606", "status": "affected", "version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74", "versionType": "git"}, {"lessThan": "862d9268f40a6e10cef24eb226e738fb69ce8aa7", "status": "affected", "version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74", "versionType": "git"}, {"lessThan": "22c82f33ff0b68d37041adf1dea5533a5863cd31", "status": "affected", "version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74", "versionType": "git"}, {"lessThan": "aa118c8f61d59387961d58ffae831c5259a9f222", "status": "affected", "version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/line6/pcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.0"}, {"lessThan": "4.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.61", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: Clear prev_fbuf on capture buffer release\n\nA KASAN slab-use-after-free read was reported in submit_audio_out_urb()\nwhen generating an impulse test signal:\n\n BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]\n BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249\n Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785\n\n Allocated by task 11:\n kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144\n line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158\n line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329\n line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728\n\n Freed by task 7785:\n kfree+0xf8/0x390 mm/slub.c:6566\n line6_buffer_release sound/usb/line6/pcm.c:176 [inline]\n line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170\n __line6_pcm_release sound/usb/line6/pcm.c:305 [inline]\n line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313\n snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183\n\nline6pcm->prev_fbuf points into the capture PCM stream buffer\n(line6pcm->in.buffer), which is updated during audio_in_callback() to\nfeed rate synchronization, software monitoring, and impulse test signal\ngeneration on playback side.\n\nWhen all capture streams are closed, line6_buffer_release() frees\npstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf.\nIf playback is subsequently started (e.g. via impulse test signal\nvolume control snd_line6_impulse_volume_put()), submit_audio_out_urb()\ndereferences the stale pointer line6pcm->prev_fbuf under in.lock,\nresulting in a slab-use-after-free read.\n\nClear prev_fbuf and prev_fsize in line6_buffer_release() when releasing\nthe capture stream buffer under in.lock, ensuring that no stale buffer\npointer can be accessed by submit_audio_out_urb()."}], "id": "CVE-2026-99271", "lastModified": "2026-11-10T19:22:31.093", "metrics": {}, "published": "2026-11-07T14:17:02.337", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/22c82f33ff0b68d37041adf1dea5533a5863cd31"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/862d9268f40a6e10cef24eb226e738fb69ce8aa7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aa118c8f61d59387961d58ffae831c5259a9f222"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d063975ed22cdc2cb609a9828e5f658448193606"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of service via use-after-free in ALSA Line 6 audio driver", "id": "2568634", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568634"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Line 6 USB audio driver. When releasing audio capture buffers, the driver fails to clear an internal buffer pointer, leaving a stale reference to freed memory. A local user can exploit this issue by triggering audio playback after closing a capture stream, resulting in a use-after-free condition that may lead to a denial of service (system crash) or unauthorized memory disclosure."], "mitigation": {"lang": "en:us", "value": "Prevent the snd-usb-line6 kernel module from being loaded.\n1. Add configuration files to /etc/modprobe.d to disable module loading:\n# echo \"install snd-usb-line6 /bin/true\" > /etc/modprobe.d/disable-snd-usb-line6.conf\n# echo \"blacklist snd-usb-line6\" >> /etc/modprobe.d/disable-snd-usb-line6.conf\n2. Unload the module if it is currently active:\n# modprobe -r snd-usb-line6\nCaveats:\nDisabling this module prevents the system from interfacing with any connected Line 6 USB audio hardware.\nWarning:\nIf the module is currently in use by running processes or sound daemons, unloading may not succeed immediately and a system restart will be required for the change to take effect."}, "name": "CVE-2026-99271", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-07T14:08:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99271\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99271\nhttps://git.kernel.org/stable/c/22c82f33ff0b68d37041adf1dea5533a5863cd31\nhttps://git.kernel.org/stable/c/862d9268f40a6e10cef24eb226e738fb69ce8aa7\nhttps://git.kernel.org/stable/c/aa118c8f61d59387961d58ffae831c5259a9f222"], "statement": "This vulnerability is evaluated as having a Moderate impact because exploitation requires local access and the physical presence or attachment of specialized Line 6 USB audio hardware. An authenticated local attacker could leverage the dangling buffer pointer to crash the system and cause a denial of service, but remote exploitation is not possible. Standard Red Hat Enterprise Linux deployments rarely interface with these consumer audio devices, severely limiting the attack surface in production environments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74,862d9268f40a6e10cef24eb226e738fb69ce8aa7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74,22c82f33ff0b68d37041adf1dea5533a5863cd31)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74,aa118c8f61d59387961d58ffae831c5259a9f222)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.61,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74,862d9268f40a6e10cef24eb226e738fb69ce8aa7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74,22c82f33ff0b68d37041adf1dea5533a5863cd31)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74,aa118c8f61d59387961d58ffae831c5259a9f222)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.61,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-07T16:00:17.572068+00:00", "updated": "2026-11-08T04:30:14.849189+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}