All vulnerabilities
CVE-2026-98428

Linux: ALSA: usb: 6fire: Avoid embedded URBs

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3ef9093d83ffecb8e5f6c9d5769a52d39df74f7aAlso 8b8559aeaba2e51cfee1779b2383b085991f7d81, 52a43c2d57e774489ac3fbbac06ff02f19bd9a52 and 7 moreCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3ef9093d83ffecb8e5f6c9d5769a52d39df74f7aLinuxCVE List
  • 8b8559aeaba2e51cfee1779b2383b085991f7d81LinuxCVE List
  • 52a43c2d57e774489ac3fbbac06ff02f19bd9a52LinuxCVE List
  • 999f433c09e4668412bd68ca207ae2b4af863862LinuxCVE List
  • 9fe49dbc023e82dfaee7b245997d820d01742a9aLinuxCVE List
  • 6.1.189LinuxCVE List
Show all 10 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb: 6fire: Avoid embedded URBs

The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously.

For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence it's found in urb.iso_frame_desc[] instead.

The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect.

No functional changes, only compile-tested.

Text from CVE List

Affected versions 17

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3ef9093d83ffecb8e5f6c9d5769a52d39df74f7aCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8b8559aeaba2e51cfee1779b2383b085991f7d81CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 52a43c2d57e774489ac3fbbac06ff02f19bd9a52CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 999f433c09e4668412bd68ca207ae2b4af863862CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d181434549b3da668110a25d743848cce9897f4eCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9fe49dbc023e82dfaee7b245997d820d01742a9aCVE List
  • Linuxaffected: all versions before 6.1.189CVE List
  • Linuxaffected: all versions before 6.6.158CVE List
  • Linuxaffected: all versions before 6.12.112CVE List
  • Linuxaffected: all versions before 6.18.54CVE List
  • Linuxaffected: all versions before 7.2.8CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6