CVE-2026-64601
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
06/08/2026
Last modified:
17/08/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission<br />
<br />
In capture_urb_complete(), usb_anchor_urb() is called on every<br />
completion callback, but the URB is already anchored from the<br />
initial submission in tascam_trigger_start(). Each redundant call<br />
corrupts the anchor&#39;s doubly-linked list and inflates the URB<br />
refcount. When usb_kill_anchored_urbs() traverses the list during<br />
stream stop / suspend / disconnect, the corrupted list leads to<br />
use-after-free.<br />
<br />
Remove the redundant usb_anchor_urb() from the resubmit path.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH