CVE-2026-64601
Received Received - Intake

USB Anchor List Corruption in Linux Kernel ALSA Driver

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission In capture_urb_complete(), usb_anchor_urb() is called on every completion callback, but the URB is already anchored from the initial submission in tascam_trigger_start(). Each redundant call corrupts the anchor's doubly-linked list and inflates the URB refcount. When usb_kill_anchored_urbs() traverses the list during stream stop / suspend / disconnect, the corrupted list leads to use-after-free. Remove the redundant usb_anchor_urb() from the resubmit path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-64601
EUVD
EUVD-2026-53787

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the ALSA us144mkii driver's capture_urb_complete function. The issue occurs when usb_anchor_urb() is called redundantly during each URB completion callback, corrupting the anchor's doubly-linked list and inflating the URB refcount. This leads to a use-after-free condition when usb_kill_anchored_urbs() traverses the corrupted list during stream stop, suspend, or disconnect.

Detection Guidance

This vulnerability is specific to the Linux kernel's ALSA us144mkii driver and cannot be detected via network scans. Check kernel logs for errors related to usb_anchor_urb corruption or use-after-free events during USB audio device operations.

Impact Analysis

This vulnerability could cause system instability, crashes, or arbitrary code execution if exploited. It may lead to denial-of-service conditions or data corruption when handling audio streams on affected systems using the TASCAM US-144Mkii audio interface.

Mitigation Strategies

Update the Linux kernel to a patched version where the redundant usb_anchor_urb call in capture_urb_complete() has been removed. Avoid using TASCAM US-144Mkii audio interfaces until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart