CVE-2026-74639

A flaw was found in the Linux kernel, specifically within the ALSA us144mkii driver. The capture_urb_complete() function resubmits capture Urban Request Blocks (URBs) without properly re-anchoring them. This oversight allows URBs to remain queued on the host controller even after their associated memory has been freed. A local attacker could exploit this use-after-free vulnerability by manipulating device-supplied data, potentially leading to arbitrary code execution or a denial of service.

A use-after-free flaw was found in the Linux kernel's ALSA us144mkii USB audio driver. The capture_urb_complete() function can resubmit capture USB Request Blocks (URBs) without re-anchoring them, causing the capture anchor to become empty after the first completion. As a result, during device disconnect, suspend, stream stop, or URB cleanup, usb_kill_anchored_urbs() may return without waiting for capture URBs that remain queued on the host controller. The associated transfer buffers and driver state can then be freed while those URBs are still active. A subsequent URB completion may write device-supplied capture data into freed memory and dereference the freed driver object. A local user with access to the affected ALSA capture device, or otherwise delegated control of the USB device, may be able to trigger the vulnerable lifecycle without administrative privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the snd-usb-us144mkii kernel module from loading by blacklisting it.

1. Create a configuration file to prevent the module from loading:

echo "blacklist snd-usb-us144mkii" > /etc/modprobe.d/snd-usb-us144mkii.conf
echo "install snd-usb-us144mkii /bin/true" >> /etc/modprobe.d/snd-usb-us144mkii.conf

2. If the module is currently loaded, unload it:

modprobe -r snd-usb-us144mkii

Caveats: Disabling this module prevents the system from recognizing and using TASCAM US-144MKII audio hardware. If the driver is actively in use by running processes, a system reboot may be required to ensure the module is fully unloaded and cannot be reloaded.