{"id":"CVE-2026-98428","revision":"a74687a01a1e42eb83579cd68041694f","records":[{"revision":"a74687a01a1e42eb83579cd68041694f","observedAt":"2026-10-26T08:20:49.483+00:00","statement":{"source":"cve-program","id":"CVE-2026-98428","aliases":[],"title":"ALSA: usb: 6fire: Avoid embedded URBs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb: 6fire: Avoid embedded URBs\n\nThe USB 6fire driver uses URBs embedded in different structs for PCM,\nMIDI and communication, and this is basically a buggy implementation\nnowadays; since a URB is managed with a refcount, this may lead to a\nUAF when the URB is released asynchronously.\n\nFor addressing the problem, this patch converts those embedded URBs to\nones that are properly allocated via usb_alloc_urb().  The\npcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence\nit's found in urb.iso_frame_desc[] instead.\n\nThe conversions are rather straightforward; each embedded struct urb\nis changed to a pointer, and its callers are updated accordingly.\nThe resource for those structs are released in the common destructor\nfunctions (usb6fire_comm_free(), etc), which are called at both the\ninit error path and the disconnect.\n\nNo functional changes, only compile-tested.","state":0,"publishedAt":"2026-10-14T13:27:54.364+00:00","modifiedAt":"2026-10-26T06:55:43.958+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/usb/6fire/comm.c\",\n                        \"sound/usb/6fire/comm.h\",\n                        \"sound/usb/6fire/midi.c\",\n                        \"sound/usb/6fire/midi.h\",\n                        \"sound/usb/6fire/pcm.c\",\n                        \"sound/usb/6fire/pcm.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9\",\n                            \"lessThan\": \"3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9\",\n                            \"lessThan\": \"8b8559aeaba2e51cfee1779b2383b085991f7d81\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9\",\n                            \"lessThan\": \"52a43c2d57e774489ac3fbbac06ff02f19bd9a52\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9\",\n                            \"lessThan\": \"999f433c09e4668412bd68ca207ae2b4af863862\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9\",\n                            \"lessThan\": \"d181434549b3da668110a25d743848cce9897f4e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c6d43ba816d1cf1d125bfbfc938f2a28a87facf9\",\n                            \"lessThan\": \"9fe49dbc023e82dfaee7b245997d820d01742a9a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"sound/usb/6fire/comm.c\",\n                        \"sound/usb/6fire/comm.h\",\n                        \"sound/usb/6fire/midi.c\",\n                        \"sound/usb/6fire/midi.h\",\n                        \"sound/usb/6fire/pcm.c\",\n                        \"sound/usb/6fire/pcm.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.39\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.39\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.54\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a","https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81","https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52","https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862","https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e","https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98428","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98428","identifiers":["CVE-2026-98428"]},"retained":false,"historicalAffected":[]}],"coverage":[]}