CVE-2026-64601

The vulnerability arises in the ALSA us144mkii driver when usb_anchor_urb() is called redundantly during each capture completion callback. The redundant anchoring corrupts the doubly‑linked list that tracks pending URBs and inflates their reference count. When the driver later attempts to kill anchored URBs during stream stop, suspend, or disconnect, the corrupted list leads to a use‑after‑free condition, which could either crash the kernel or allow an attacker to execute code with kernel privileges. The flaw manifests as a typical use‑after‑free weakness (CWE‑416) with potential for severe compromise. Based on the description, it is not clear whether this can be triggered remotely or only from a local attacker with the ability to initiate audio capture, so the attack vector is inferred to be local with elevated privileges.

The flaw exists in the Linux kernel’s ALSA sub‑system, specifically the us144mkii driver. All versions of the Linux kernel that included the original implementation—prior to the removal of the redundant usb_anchor_urb() call—are affected. No explicit version range is supplied, so any kernel where the us144mkii driver is present and the bad code path exists is potentially vulnerable.

The CVSS score is 7.8, indicating high severity, but the EPSS score is < 1% limiting an exact quantitative risk assessment. Because the issue is a classic use‑after‑free, the potential impact is high. However, the flaw appears to require local access to the affected audio device and may involve triggering specific capture operations. The vulnerability is not listed in CISA’s KEV catalogue, so there is no known widespread exploitation at the time of this analysis. Attackers would likely need to craft a scenario that initiates repeated capture completions to corrupt the anchor list, after which they could exploit the subsequent use‑after‑free during device teardown. In the absence of a public exploit, the threat remains mainly theoretical, but caution is advised because kernel use‑after‑free bugs can enable privilege escalation or denial of service.