CVE-2026-74639

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: us144mkii: re-anchor capture URBs on resubmission<br /> <br /> capture_urb_complete() resubmits each capture URB without anchoring it:<br /> <br /> usb_get_urb(urb);<br /> ret = usb_submit_urb(urb, GFP_ATOMIC);<br /> <br /> Anchoring is a property of a submission, not of the URB. The giveback<br /> path calls usb_unanchor_urb() before urb-&gt;complete(), so an URB<br /> resubmitted from its own completion handler is off the anchor. The<br /> capture URBs are anchored once, at stream start, so from the first<br /> completion onward tascam-&gt;capture_anchor is empty.<br /> <br /> tascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the<br /> stop-work path all call usb_kill_anchored_urbs(&amp;tascam-&gt;capture_anchor)<br /> to reap the capture URBs before anything is freed. With the anchor empty<br /> those calls return immediately and the URBs stay queued on the host<br /> controller.<br /> <br /> tascam_free_urbs() then returns the capture transfer buffers with<br /> usb_free_coherent(), and snd_card_free() releases the snd_card<br /> allocation that embeds tascam (card-&gt;private_data). The controller<br /> completes the queued URBs afterwards, writing device-supplied data into<br /> the freed transfer buffer, and capture_urb_complete() dereferences the<br /> freed driver object.<br /> <br /> KASAN on 7.2.0-rc5 (arm64):<br /> <br /> BUG: KASAN: slab-use-after-free in dummy_timer<br /> Write of size 512 at addr ffff000015b62000<br /> __asan_memcpy<br /> dummy_timer<br /> hrtimer_run_softirq<br /> Allocated by task 64:<br /> usb_alloc_coherent<br /> tascam_alloc_urbs<br /> tascam_probe<br /> Freed by task 170:<br /> usb_free_coherent<br /> tascam_free_urbs<br /> tascam_disconnect<br /> usb_unbind_interface<br /> <br /> BUG: KASAN: slab-use-after-free in capture_urb_complete<br /> Read of size 4 at addr ffff0000170ee878<br /> Freed by task 170:<br /> release_card_device<br /> snd_card_free<br /> tascam_disconnect<br /> <br /> Restore the usb_anchor_urb() between the reference count bump and the<br /> resubmission. That also makes the handler&amp;#39;s usb_unanchor_urb() failure<br /> arm meaningful again and restores usb_kill_anchored_urbs() as a barrier<br /> on the disconnect, suspend and stop-work paths.<br /> <br /> The anchoring was removed on the premise that the URB is already anchored<br /> from the initial submission, which does not hold once the first giveback<br /> has run.<br /> <br /> Discovered by XBOW, triaged by Baul Lee