CVE-2026-64601

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ALSA us144mkii driver where the capture urb complete() function calls usb anchor urb() on every completion callback. Since the URB (USB Request Block) is already anchored during the initial submission in tascam trigger start(), these redundant calls corrupt the anchor's doubly-linked list and increase the URB refcount. This corruption leads to a use-after-free condition when usb kill anchored urbs() traverses the list during stream stop, suspend, or disconnect operations. Use-after-free is a scenario where a program continues to use a pointer after the memory it points to has been freed.

Recommendations Remove the redundant usb anchor urb() call from the resubmit path.