CVE-2026-98428

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb: 6fire: Avoid embedded URBs

The USB 6fire driver uses URBs embedded in different structs for PCM,

MIDI and communication, and this is basically a buggy implementation

nowadays; since a URB is managed with a refcount, this may lead to a

UAF when the URB is released asynchronously.

For addressing the problem, this patch converts those embedded URBs to

ones that are properly allocated via usb_alloc_urb(). The

pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence

it's found in urb.iso_frame_desc[] instead.

The conversions are rather straightforward; each embedded struct urb

is changed to a pointer, and its callers are updated accordingly.

The resource for those structs are released in the common destructor

functions (usb6fire_comm_free(), etc), which are called at both the

init error path and the disconnect.

No functional changes, only compile-tested.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References