Cloudanix VulnDB

CVE-2026-98428

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A memory-handling mistake in Linux support for certain USB audio devices could cause crashes or let an attacker run code if they can plug in the hardware.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the ALSA usb 6fire driver from managing URBs as embedded structs instead of reference-counted allocations via usb_alloc_urb, allowing asynchronous release to free memory still referenced by PCM, MIDI or communication paths.

Why it matters to the business

Linux systems using USB 6fire audio hardware face risk of kernel crashes or instability that can cause denial of service; low exploit likelihood means limited immediate operational disruption but still requires timely kernel updates on affected distributions.

How an attack unfolds

An attacker connects a compatible USB 6fire device and triggers PCM, MIDI or communication operations that cause the embedded URB to be released asynchronously while still in use, resulting in a use-after-free that may be leveraged for local privilege escalation or system crash.

How to fix it

Apply the upstream kernel patch that replaces embedded URBs with properly allocated ones using usb_alloc_urb and updates the common destructor paths; obtain the fixed kernel version from your Linux distribution vendor.

How to confirm the fix worked

Confirm the driver source uses pointer-based URBs allocated via usb_alloc_urb rather than embedded structs, verify that usb6fire_comm_free and related destructors handle release correctly, and test device attach/detach and audio functionality after the update.

Typical attack path

  1. Attach a USB 6fire device to the target system
  2. Initiate audio, MIDI or control operations through the ALSA driver
  3. Trigger asynchronous URB release conditions
  4. Exploit the resulting use-after-free for memory corruption

How to detect it

Inspect kernel logs and dmesg for use-after-free warnings or oopses referencing usb6fire or ALSA URB handling, and correlate USB device attach events with subsequent audio subsystem failures.

What your security team should do

  • Prioritize kernel updates from distribution vendors within normal patch cycles given low EPSS and absence from KEV
  • Restrict use of USB 6fire devices on unpatched systems until updates are deployed
  • Review kernel configuration to ensure the usb 6fire driver is only loaded when needed

The record

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence it's found in urb.iso_frame_desc[] instead. The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect. No functional changes, only compile-tested.

Affected packages

Ecosystem Package Introduced Fixed