PT-2026-64712 · Linux · Linux
CVE-2026-64491
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usx2y: us144mkii: fix work UAF on disconnect
tascam disconnect() cancels capture work and midi in work before
usb kill anchored urbs() kills the capture/MIDI-in URBs. Those URBs
self-resubmit, and their completion handlers reschedule the work.
A URB that completes in the small window between cancel work sync() and
usb kill anchored urbs() therefore re-arms the work after its only
cancel. Nothing cancels it again before snd card free() frees the
card-private tascam structure, so the work handler then runs on freed
memory.
Kill the anchored URBs before cancelling the work; once the work is
cancelled no remaining URB can complete to re-arm it.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux