CVE-2026-74639 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
ALSA: us144mkii: re-anchor capture URBs on resubmission
capture_urb_complete() resubmits each capture URB without anchoring it:
usb_get_urb(urb); ret = usb_submit_urb(urb, GFP_ATOMIC);
Anchoring is a property of a submission, not of the URB. The giveback path calls usb_unanchor_urb() before urb->complete(), so an URB resubmitted from its own completion handler is off the anchor. The capture URBs are anchored once, at stream start, so from the first completion onward tascam->capture_anchor is empty.
tascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the stop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor) to reap the capture URBs before anything is freed. With the anchor empty those calls return immediately and the URBs stay queued on the host controller.
tascam_free_urbs() then returns the capture transfer buffers with usb_free_coherent(), and snd_card_free() releases the snd_card allocation that embeds tascam (card->private_data). The controller completes the queued URBs afterwards, writing device-supplied data into the freed transfer buffer, and capture_urb_complete() dereferences the freed driver object.
KASAN on 7.2.0-rc5 (arm64):
BUG: KASAN: slab-use-after-free in dummy_timer Write of size 512 at addr ffff000015b62000 __asan_memcpy dummy_timer hrtimer_run_softirq Allocated by task 64: usb_alloc_coherent tascam_alloc_urbs tascam_probe Freed by task 170: usb_free_coherent tascam_free_urbs tascam_disconnect usb_unbind_interface
BUG: KASAN: slab-use-after-free in capture_urb_complete Read of size 4 at addr ffff0000170ee878 Freed by task 170: release_card_device snd_card_free tascam_disconnect
Restore the usb_anchor_urb() between the reference count bump and the resubmission. That also makes the handler's usb_unanchor_urb() failure arm meaningful again and restores usb_kill_anchored_urbs() as a barrier on the disconnect, suspend and stop-work paths.
The anchoring was removed on the premise that the URB is already anchored from the initial submission, which does not hold once the first giveback has run.
Discovered by XBOW, triaged by Baul Lee <[email protected]>
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
This vulnerability represents a critical use-after-free condition within the Linux kernel's ALSA USB audio driver for Tascam US144mkII devices, stemming from improper handling of USB Request Block anchoring during asynchronous completion callbacks. The core technical flaw resides in the capture_urb_complete function, which is invoked when a USB transfer completes. In this handler, the code attempts to resubmit the URB to maintain continuous audio capture by calling usb_get_urb followed immediately by usb_submit_urb without re-anchoring the structure. This oversight ignores the lifecycle mechanics of USB anchoring in the kernel; while an anchor is attached during initial submission via usb_anchor_urb, the completion path explicitly calls usb_unanchor_urb before invoking the driver's complete callback. Consequently, once the first URB completes and triggers this handler, it is no longer associated with the capture anchor list. This creates a state where subsequent resubmitted URBs are submitted as unanchored transfers rather than anchored ones, fundamentally breaking the synchronization mechanism designed to manage bulk of asynchronous I/O operations.
The operational impact of this flaw manifests as severe memory corruption and potential kernel panic due to slab-use-after-free errors. Because the driver relies on usb_kill_anchored_urbs to safely terminate pending transfers during disconnect, suspend, or stop-work sequences, an empty anchor list causes these cleanup functions to return immediately without waiting for in-flight URBs to complete. As a result, the host controller continues processing queued URBs even after the driver has proceeded to free associated resources. Specifically, tascam_free_urbs releases the coherent DMA memory buffers using usb_free_coherent, and snd_card_free subsequently deallocates the main device structure containing the driver context. If the hardware completes these pending transfers during this window, it writes data into freed memory regions or dereferences a dangling pointer to the now-freed driver object. This leads to arbitrary code execution possibilities or system instability, as evidenced by KASAN reports showing write operations into allocated but subsequently freed slab objects and reads from released card device structures.
From a security taxonomy perspective, this vulnerability aligns with CWE-416 Use After Free, where memory is accessed after it has been freed, leading to undefined behavior that can be exploited for privilege escalation or denial of service. The attack vector involves triggering the disconnect or suspend sequence while active audio capture streams are running, forcing the race condition between URB completion and resource deallocation. In terms of MITRE ATT&CK mapping, this falls under T1059 Command and Scripting Interpreter if an attacker can leverage the memory corruption to execute arbitrary code within the kernel context, though it is primarily categorized as a reliability issue exploitable for local privilege escalation via T1068 Exploitation for Privilege Escalation. The flaw highlights the complexity of managing asynchronous hardware interactions in operating systems and underscores the necessity of strict adherence to driver model protocols regarding resource lifecycle management.
The resolution involves restoring the usb_anchor_urb call between incrementing the URB reference count and resubmitting it within the completion handler. This ensures that every resubmitted URB remains part of the anchor list, allowing usb_kill_anchored_urbs to function correctly as a synchronization barrier during teardown operations. By keeping the URBs anchored, the driver guarantees that all pending transfers are completed or cancelled before memory is released, thereby eliminating the race condition. This fix also restores the semantic validity of error handling paths within the completion handler and ensures robust behavior across disconnect, suspend, and stop-work scenarios. The issue was discovered by XBOW and triaged by Baul Lee, emphasizing the importance of static analysis and fuzzing in identifying subtle concurrency bugs in low-level kernel drivers that interact directly with hardware peripherals.