CVE-2026-74639

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc5

Description A slab-use-after-free issue exists in the ALSA us144mkii driver. The capture urb complete() function resubmits capture URBs (USB Request Blocks) without re-anchoring them. Because anchoring is a property of the submission and not the URB itself, the URBs become unanchored after the first completion. Consequently, functions such as tascam free urbs(), tascam disconnect(), and tascam suspend() fail to reap these URBs via usb kill anchored urbs(), leaving them queued on the host controller.

When the driver frees the capture transfer buffers using usb free coherent() and releases the snd card allocation, the host controller may still complete the queued URBs. This leads to device-supplied data being written into freed memory buffers and the capture urb complete() function dereferencing a freed driver object.

Recommendations Update the Linux kernel to version 7.2.0-rc5 or later to ensure usb anchor urb() is called during URB resubmission.