CVE-2026-64601

HighCVSS 7.8/10Last modified Aug 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on each resubmission

In capture_urb_complete(), usb_anchor_urb() is called on every completion callback, but the URB is already anchored from the initial submission in tascam_trigger_start(). Each redundant call corrupts the anchor's doubly-linked list and inflates the URB refcount. When usb_kill_anchored_urbs() traverses the list during stream stop / suspend / disconnect, the corrupted list leads to use-after-free.

Remove the redundant usb_anchor_urb() from the resubmit path.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= c1bb0c13e430623c26543baae5bb9ae21139db87, < 16f14f55141d4c55c3f321f93c328fff7cd6860a; >= c1bb0c13e430623c26543baae5bb9ae21139db87, < ab1db64912428cdf06a4f9542e16e0575e9ad59f; >= c1bb0c13e430623c26543baae5bb9ae21139db87, < 5cff1529a2f9b3461a7f5a6e36a86682fc290534
Linux	Linux	6.18

References

Timeline

Published: Aug 6, 2026
Last modified: Aug 17, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-64602In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the re CVE-2026-64603In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion CVE-2026-64604In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest m CVE-2026-646069.8Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. CVE-2026-646075.3HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounte CVE-2026-646089.8Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the fiel CVE-2026-646099.1Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read bey CVE-2026-646109.8Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache servi CVE-2026-646117.5A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised CVE-2026-646127.5A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error reco CVE-2026-646136.2Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW. The segment is CVE-2026-646143.8Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The s