CVE-2026-64491

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the ALSA usx2y driver for us144mkii devices. The tascam disconnect() function cancels capture work and midi in work before calling usb kill anchored urbs(). Because the USB Request Blocks (URBs) self-resubmit, their completion handlers can reschedule the work in the brief window between cancel work sync() and usb kill anchored urbs(). This re-arms the work after the initial cancellation. Subsequently, snd card free() frees the card-private tascam structure, allowing the work handler to execute on freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.