CVE-2026-64601

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio driver. This vulnerability occurs due to an error in handling USB audio device requests, where a specific function is called unnecessarily during the resubmission of a USB Request Block (URB). This redundant call can corrupt internal data structures, leading to a 'use-after-free' condition. A use-after-free vulnerability is a type of memory corruption that can cause system instability, such as crashes, or in some cases, could be exploited to gain unauthorized control over the system.

A use-after-free can occur in the ALSA us144mkii USB audio capture path because capture_urb_complete() re anchors an URB on every completion even though the URB was already anchored during initial stream submission. Repeated anchoring corrupts the USB anchor doubly linked list and inflates the URB reference count, so later cleanup through usb_kill_anchored_urbs() during stream stop, suspend, or disconnect may traverse corrupted state and dereference freed memory. For the CVSS the PR:L is used because a local user with access to the ALSA capture device can plausibly start and stop capture streams, while physical disconnect or system suspend may also reach the same cleanup path. The issue is not network reachable and requires local interaction with the affected USB audio device. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.