CVE-2026-64491 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usx2y: us144mkii: fix work UAF on disconnect
tascam_disconnect() cancels capture_work and midi_in_work before usb_kill_anchored_urbs() kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule the work.
A URB that completes in the small window between cancel_work_sync() and usb_kill_anchored_urbs() therefore re-arms the work after its only cancel. Nothing cancels it again before snd_card_free() frees the card-private tascam structure, so the work handler then runs on freed memory.
Kill the anchored URBs before cancelling the work; once the work is cancelled no remaining URB can complete to re-arm it.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability exists within the Linux kernel's ALSA subsystem specifically in the usx2y driver implementation for Tascam devices, where a use-after-free condition occurs during device disconnection. The flaw manifests in the tascam_disconnect() function which manages the cleanup process for USB audio devices. The issue arises from an improper sequence of operations that creates a race condition between work queue cancellation and URB (USB Request Block) termination. When a Tascam device disconnects, the driver attempts to clean up its resources by canceling pending work items before terminating the underlying USB transfers. However, this ordering creates a temporal window where URB completion handlers can execute and reschedule work items after the initial cancellation but before the final URB termination occurs.
The technical flaw stems from a fundamental violation of resource management principles where the driver fails to ensure exclusive access to work queue operations during cleanup. The capture_work and midi_in_work structures are cancelled using cancel_work_sync() which waits for any currently executing work to complete, but this is insufficient because URB completion handlers can still reschedule these work items before usb_kill_anchored_urbs() terminates the underlying USB transfers. This creates a window where a URB completes after cancel_work_sync() returns but before usb_kill_anchored_urbs() executes, allowing the work handler to re-arm itself with a reference to memory that has already been freed.
The operational impact of this vulnerability is severe as it can lead to kernel memory corruption and system instability when a Tascam device disconnects from a Linux system. The use-after-free condition occurs because the work handler attempts to access data structures that have already been deallocated during card cleanup, potentially allowing malicious actors to trigger arbitrary code execution or cause denial of service conditions. This vulnerability affects systems using the Linux kernel's USB audio subsystem and particularly impacts devices using the Tascam US-144mkII and similar models that rely on the usx2y driver for USB audio functionality. The issue demonstrates a classic race condition pattern that violates the principle of proper resource lifecycle management in concurrent systems.
This vulnerability maps directly to CWE-416, Use After Free, which specifically addresses situations where a program continues to use memory after it has been freed, and also relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization. The flaw follows ATT&CK technique T1059.007 for Command and Scripting Interpreter: Python, though more accurately represents a kernel-level privilege escalation vector through improper memory management. The recommended mitigation involves reordering the cleanup operations to terminate all URBs before cancelling any work items, ensuring that no remaining USB transfers can complete and reschedule work after the cancellation has occurred. This approach aligns with best practices for resource cleanup in concurrent systems and prevents the temporal window where memory corruption can occur during device disconnection scenarios.
The fix implements a fundamental change to the driver's resource management sequence by ensuring that usb_kill_anchored_urbs() is called before cancel_work_sync(). This ordering guarantees that all URBs are terminated and cannot complete to reschedule work items, thereby eliminating the window where work handlers might access freed memory. The solution demonstrates proper kernel programming practices for handling concurrent resource cleanup operations and prevents the specific race condition that led to the use-after-free vulnerability. This approach ensures that once work items are cancelled, no subsequent URB completions can reactivate them, providing a clean separation between resource termination and cleanup operations that maintains system stability during device disconnection events.