CVE-2026-98428

Received Received - Intake

USB 6fire Driver Use-After-Free Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence it's found in urb.iso_frame_desc[] instead. The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect. No functional changes, only compile-tested.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98428

EUVD

EUVD-2026-101077

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux	Linux	0
Linux	Linux	0
Linux	Linux	0
Linux	Linux	0
Linux	Linux	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the USB 6fire driver improperly using embedded URBs (USB Request Blocks) for PCM, MIDI, and communication. This outdated approach can lead to a Use-After-Free (UAF) condition when URBs are released asynchronously due to incorrect refcount management.

Detection Guidance

This vulnerability is specific to the Linux kernel's USB 6fire driver and involves improper handling of URBs. Detection requires checking if the affected driver is loaded and inspecting kernel logs for related errors or warnings.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause system instability, crashes, or potentially execute arbitrary code with kernel privileges. It primarily affects systems using the USB 6fire audio interface driver.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue involving a use-after-free (UAF) condition in the USB 6fire driver due to improper URB management. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest version that includes the fix for this vulnerability. If you cannot update immediately, consider disabling the USB 6fire driver if it is not in use.

Hi! I’m here to help you understand CVE-2026-98428. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70