CVE-2026-72443

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints

MIDI 2.0 input URBs are started during snd_usb_midi_v2_create(). A

later setup failure can still jump to snd_usb_midi_v2_free(), which

currently frees each endpoint and its coherent URB buffers without first

stopping the submitted URBs. A completion can then dereference the

embedded URB context and endpoint state after they have been freed, or

try to resubmit from the stale endpoint.

This was observed as a KASAN slab-use-after-free in

input_urb_complete().

The buggy scenario involves two paths, with each column showing the order

within that path:

probe error path: USB completion path:

1. start_input_streams() submits 1. The HCD still owns a

input URBs. submitted input URB.

2. A later setup helper returns 2. input_urb_complete() runs

an error. wi

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References