The ALSA US144MKII driver in the Linux kernel can resubmit capture URBs without correctly re‑anchoring them, causing the URBs to become unanchored after the first completion. When the URBs are later killed by usb_kill_anchored_urbs, the driver’s anchor is empty and the queued URBs remain on the host controller. As a result, the controller continues to write device‑supplied data into transfer buffers that have already been freed, and the completion handler dereferences a freed driver object. The issue manifests as a use‑after‑free vulnerability that can corrupt memory and potentially allow an attacker to execute arbitrary code within kernel mode.

This flaw affects the Linux kernel, specifically the ALSA US144MKII driver used with Tascam audio devices. The vulnerability applies to all kernel versions prior to the patch that re‑anchors URBs; no specific version range is listed, but the kernel implements the US144MKII driver across many distributions.

Because the defect is a kernel‑level use‑after‑free, it carries a high risk of local privilege escalation or a denial‑of‑service crash. The EPSS score is not available, but the lack of a KEV listing does not reduce the severity. An attacker would need local access to the affected audio subsystem—typically via a connected Tascam device—to trigger the URB resubmission flow and exploit the memory corruption. The patch restores proper anchoring and kills the anchored URBs, eliminating the use‑after‑free path.