CVE-2026-31581

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: 6fire: fix use-after-free on disconnect

In usb6fire_chip_abort(), the chip struct is allocated as the card's

private data (via snd_card_new with sizeof(struct sfire_chip)). When

snd_card_free_when_closed() is called and no file handles are open, the

card and embedded chip are freed synchronously. The subsequent

chip->card = NULL write then hits freed slab memory.

Call trace:

usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]

usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182

usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458

...

hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953

Fix by moving the card lifecycle out of usb6fire_chip_abort() and into

usb6fire_chip_disconnect(). The card pointer is saved in a local

before any teardown, snd_card_disconnect() is called first to prevent

new opens, URBs are aborted while chip is still valid, and

snd_card_free_when_closed()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References