CVE-2026-98428

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb: 6fire: Avoid embedded URBs

The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously.

For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb alloc urb(). The pcm urb.packets[] is gone, as it's allocated by usb alloc urb(), hence it's found in urb.iso frame desc[] instead.

The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire comm free(), etc), which are called at both the init error path and the disconnect.

No functional changes, only compile-tested.