{"api_version":"1","generated_at":"2026-08-22T17:42:40+00:00","cve":"CVE-2026-74639","urls":{"html":"https://cve.report/CVE-2026-74639","api":"https://cve.report/api/cve/CVE-2026-74639.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74639","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74639"},"summary":{"title":"ALSA: us144mkii: re-anchor capture URBs on resubmission","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us144mkii: re-anchor capture URBs on resubmission\n\ncapture_urb_complete() resubmits each capture URB without anchoring it:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nAnchoring is a property of a submission, not of the URB.  The giveback\npath calls usb_unanchor_urb() before urb->complete(), so an URB\nresubmitted from its own completion handler is off the anchor.  The\ncapture URBs are anchored once, at stream start, so from the first\ncompletion onward tascam->capture_anchor is empty.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the\nstop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor)\nto reap the capture URBs before anything is freed.  With the anchor empty\nthose calls return immediately and the URBs stay queued on the host\ncontroller.\n\ntascam_free_urbs() then returns the capture transfer buffers with\nusb_free_coherent(), and snd_card_free() releases the snd_card\nallocation that embeds tascam (card->private_data).  The controller\ncompletes the queued URBs afterwards, writing device-supplied data into\nthe freed transfer buffer, and capture_urb_complete() dereferences the\nfreed driver object.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n  BUG: KASAN: slab-use-after-free in dummy_timer\n  Write of size 512 at addr ffff000015b62000\n   __asan_memcpy\n   dummy_timer\n   hrtimer_run_softirq\n  Allocated by task 64:\n   usb_alloc_coherent\n   tascam_alloc_urbs\n   tascam_probe\n  Freed by task 170:\n   usb_free_coherent\n   tascam_free_urbs\n   tascam_disconnect\n   usb_unbind_interface\n\n  BUG: KASAN: slab-use-after-free in capture_urb_complete\n  Read of size 4 at addr ffff0000170ee878\n  Freed by task 170:\n   release_card_device\n   snd_card_free\n   tascam_disconnect\n\nRestore the usb_anchor_urb() between the reference count bump and the\nresubmission.  That also makes the handler's usb_unanchor_urb() failure\narm meaningful again and restores usb_kill_anchored_urbs() as a barrier\non the disconnect, suspend and stop-work paths.\n\nThe anchoring was removed on the premise that the URB is already anchored\nfrom the initial submission, which does not hold once the first giveback\nhas run.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-22 16:16:37","updated_at":"2026-08-22 16:16:37"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/2615f0fb90df8cf5a96133ca4be74294ed288604","name":"https://git.kernel.org/stable/c/2615f0fb90df8cf5a96133ca4be74294ed288604","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a5548ce916594c811bd90ce33d67baa3557a6791","name":"https://git.kernel.org/stable/c/a5548ce916594c811bd90ce33d67baa3557a6791","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7779249561d14b8a17c0c83783225794e24a587d","name":"https://git.kernel.org/stable/c/7779249561d14b8a17c0c83783225794e24a587d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74639","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74639","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 16f14f55141d4c55c3f321f93c328fff7cd6860a 7779249561d14b8a17c0c83783225794e24a587d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ab1db64912428cdf06a4f9542e16e0575e9ad59f a5548ce916594c811bd90ce33d67baa3557a6791 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5cff1529a2f9b3461a7f5a6e36a86682fc290534 2615f0fb90df8cf5a96133ca4be74294ed288604 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18.39 6.18.45 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7.1.4 7.1.9 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/usx2y/us144mkii_capture.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7779249561d14b8a17c0c83783225794e24a587d","status":"affected","version":"16f14f55141d4c55c3f321f93c328fff7cd6860a","versionType":"git"},{"lessThan":"a5548ce916594c811bd90ce33d67baa3557a6791","status":"affected","version":"ab1db64912428cdf06a4f9542e16e0575e9ad59f","versionType":"git"},{"lessThan":"2615f0fb90df8cf5a96133ca4be74294ed288604","status":"affected","version":"5cff1529a2f9b3461a7f5a6e36a86682fc290534","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/usx2y/us144mkii_capture.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.45","status":"affected","version":"6.18.39","versionType":"semver"},{"lessThan":"7.1.9","status":"affected","version":"7.1.4","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.45","versionStartIncluding":"6.18.39","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.9","versionStartIncluding":"7.1.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us144mkii: re-anchor capture URBs on resubmission\n\ncapture_urb_complete() resubmits each capture URB without anchoring it:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nAnchoring is a property of a submission, not of the URB.  The giveback\npath calls usb_unanchor_urb() before urb->complete(), so an URB\nresubmitted from its own completion handler is off the anchor.  The\ncapture URBs are anchored once, at stream start, so from the first\ncompletion onward tascam->capture_anchor is empty.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the\nstop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor)\nto reap the capture URBs before anything is freed.  With the anchor empty\nthose calls return immediately and the URBs stay queued on the host\ncontroller.\n\ntascam_free_urbs() then returns the capture transfer buffers with\nusb_free_coherent(), and snd_card_free() releases the snd_card\nallocation that embeds tascam (card->private_data).  The controller\ncompletes the queued URBs afterwards, writing device-supplied data into\nthe freed transfer buffer, and capture_urb_complete() dereferences the\nfreed driver object.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n  BUG: KASAN: slab-use-after-free in dummy_timer\n  Write of size 512 at addr ffff000015b62000\n   __asan_memcpy\n   dummy_timer\n   hrtimer_run_softirq\n  Allocated by task 64:\n   usb_alloc_coherent\n   tascam_alloc_urbs\n   tascam_probe\n  Freed by task 170:\n   usb_free_coherent\n   tascam_free_urbs\n   tascam_disconnect\n   usb_unbind_interface\n\n  BUG: KASAN: slab-use-after-free in capture_urb_complete\n  Read of size 4 at addr ffff0000170ee878\n  Freed by task 170:\n   release_card_device\n   snd_card_free\n   tascam_disconnect\n\nRestore the usb_anchor_urb() between the reference count bump and the\nresubmission.  That also makes the handler's usb_unanchor_urb() failure\narm meaningful again and restores usb_kill_anchored_urbs() as a barrier\non the disconnect, suspend and stop-work paths.\n\nThe anchoring was removed on the premise that the URB is already anchored\nfrom the initial submission, which does not hold once the first giveback\nhas run.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>"}],"providerMetadata":{"dateUpdated":"2026-08-22T15:32:18.236Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/7779249561d14b8a17c0c83783225794e24a587d"},{"url":"https://git.kernel.org/stable/c/a5548ce916594c811bd90ce33d67baa3557a6791"},{"url":"https://git.kernel.org/stable/c/2615f0fb90df8cf5a96133ca4be74294ed288604"}],"title":"ALSA: us144mkii: re-anchor capture URBs on resubmission","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-74639","datePublished":"2026-08-22T15:32:18.236Z","dateReserved":"2026-08-15T05:44:03.922Z","dateUpdated":"2026-08-22T15:32:18.236Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-22 16:16:37","lastModifiedDate":"2026-08-22 16:16:37","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74639","Ordinal":"1","Title":"ALSA: us144mkii: re-anchor capture URBs on resubmission","CVE":"CVE-2026-74639","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74639","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: us144mkii: re-anchor capture URBs on resubmission\n\ncapture_urb_complete() resubmits each capture URB without anchoring it:\n\n\tusb_get_urb(urb);\n\tret = usb_submit_urb(urb, GFP_ATOMIC);\n\nAnchoring is a property of a submission, not of the URB.  The giveback\npath calls usb_unanchor_urb() before urb->complete(), so an URB\nresubmitted from its own completion handler is off the anchor.  The\ncapture URBs are anchored once, at stream start, so from the first\ncompletion onward tascam->capture_anchor is empty.\n\ntascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the\nstop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor)\nto reap the capture URBs before anything is freed.  With the anchor empty\nthose calls return immediately and the URBs stay queued on the host\ncontroller.\n\ntascam_free_urbs() then returns the capture transfer buffers with\nusb_free_coherent(), and snd_card_free() releases the snd_card\nallocation that embeds tascam (card->private_data).  The controller\ncompletes the queued URBs afterwards, writing device-supplied data into\nthe freed transfer buffer, and capture_urb_complete() dereferences the\nfreed driver object.\n\nKASAN on 7.2.0-rc5 (arm64):\n\n  BUG: KASAN: slab-use-after-free in dummy_timer\n  Write of size 512 at addr ffff000015b62000\n   __asan_memcpy\n   dummy_timer\n   hrtimer_run_softirq\n  Allocated by task 64:\n   usb_alloc_coherent\n   tascam_alloc_urbs\n   tascam_probe\n  Freed by task 170:\n   usb_free_coherent\n   tascam_free_urbs\n   tascam_disconnect\n   usb_unbind_interface\n\n  BUG: KASAN: slab-use-after-free in capture_urb_complete\n  Read of size 4 at addr ffff0000170ee878\n  Freed by task 170:\n   release_card_device\n   snd_card_free\n   tascam_disconnect\n\nRestore the usb_anchor_urb() between the reference count bump and the\nresubmission.  That also makes the handler's usb_unanchor_urb() failure\narm meaningful again and restores usb_kill_anchored_urbs() as a barrier\non the disconnect, suspend and stop-work paths.\n\nThe anchoring was removed on the premise that the URB is already anchored\nfrom the initial submission, which does not hold once the first giveback\nhas run.\n\nDiscovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>","Type":"Description","Title":"ALSA: us144mkii: re-anchor capture URBs on resubmission"}]}}}