CVE-2026-64601 in Linux
Summary
by MITRE • 08/06/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission
In capture_urb_complete(), usb_anchor_urb() is called on every completion callback, but the URB is already anchored from the initial submission in tascam_trigger_start(). Each redundant call corrupts the anchor's doubly-linked list and inflates the URB refcount. When usb_kill_anchored_urbs() traverses the list during stream stop / suspend / disconnect, the corrupted list leads to use-after-free.
Remove the redundant usb_anchor_urb() from the resubmit path.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability resides in the Linux kernel's ALSA subsystem specifically within the us144mkii driver which handles audio capture operations for certain USB audio devices. This issue manifests as a critical memory corruption flaw that affects the USB anchor list management mechanism during audio stream processing. The problem occurs in the capture_urb_complete() function where redundant calls to usb_anchor_urb() create a cascade of memory integrity issues that can lead to system instability and potential exploitation.
The technical root cause stems from improper URB (USB Request Block) anchoring practices within the driver's capture completion handler. During normal operation, the tascam_trigger_start() function properly anchors the URBs when initiating audio capture streams, establishing a valid doubly-linked list structure within the USB anchor framework. However, the capture_urb_complete() callback function repeatedly invokes usb_anchor_urb() on each URB completion event, even though these URBs are already properly anchored from their initial submission. This redundant anchoring operation corrupts the underlying doubly-linked list structure by creating circular references and invalidating the list traversal pointers.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation and system compromise. When the audio stream is terminated through normal operations such as stream stop, system suspend, or device disconnection, the usb_kill_anchored_urbs() function attempts to clean up all anchored URBs by traversing the corrupted anchor list. The malformed list structure causes this cleanup function to follow invalid memory pointers, resulting in use-after-free conditions where freed memory locations are accessed and potentially overwritten. This creates a potential attack surface for malicious actors to exploit through carefully crafted USB audio device interactions or system state transitions.
The vulnerability aligns with CWE-459, which describes "Incomplete Cleanup" in software systems, specifically manifesting as improper resource management within the USB subsystem's anchor list handling mechanism. From an ATT&CK framework perspective, this represents a potential privilege escalation vector through kernel memory corruption (T1068) that could enable persistent access to system resources. The flaw demonstrates poor defensive programming practices in kernel space where redundant operations that appear harmless in isolation create cascading failures in the resource management subsystem.
Mitigation strategies should focus on removing the redundant usb_anchor_urb() call from the resubmit path within capture_urb_complete(), ensuring that URB anchoring occurs only once during initial submission and not during subsequent completion callbacks. The fix requires careful code review of the driver's URB lifecycle management to prevent duplicate anchoring operations while maintaining proper resource cleanup semantics. System administrators should ensure kernel updates are applied promptly, particularly in environments where USB audio devices are actively used or where security compliance requirements mandate zero-day protection against known kernel vulnerabilities. The solution also emphasizes the importance of proper kernel module testing and validation, particularly around resource management patterns that could introduce subtle but critical memory corruption issues during normal operation scenarios.