CVE-2026-64601
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission In capture_urb_complete(), usb_anchor_urb() is called on every completion callback, but the URB is already anchored from the initial submission in tascam_trigger_start(). Each redundant call corrupts the anchor's doubly-linked list and inflates the URB refcount. When usb_kill_anchored_urbs() traverses the list during stream stop / suspend / disconnect, the corrupted list leads to use-after-free. Remove the redundant usb_anchor_urb() from the resubmit path.
How to fix
- Linux Linux16f14f55141d4c55c3f321f93c328fff7cd6860a, ab1db64912428cdf06a4f9542e16e0575e9ad59f, 5cff1529a2f9b3461a7f5a6e36a86682fc290534 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c1bb0c13e430623c26543baae5bb9ae21139db87 ≤ v < 16f14f55141d4c55c3f321f93c328fff7cd6860a, c1bb0c13e430623c26543baae5bb9ae21139db87 ≤ v < ab1db64912428cdf06a4f9542e16e0575e9ad59f, c1bb0c13e430623c26543baae5bb9ae21139db87 ≤ v < 5cff1529a2f9b3461a7f5a6e36a86682fc290534, 6.18 | 16f14f55141d4c55c3f321f93c328fff7cd6860a, ab1db64912428cdf06a4f9542e16e0575e9ad59f, 5cff1529a2f9b3461a7f5a6e36a86682fc290534 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.