CVE-2026-74639

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: us144mkii: re-anchor capture URBs on resubmission

capture_urb_complete() resubmits each capture URB without anchoring it:

usb_get_urb(urb);

ret = usb_submit_urb(urb, GFP_ATOMIC);

Anchoring is a property of a submission, not of the URB. The giveback

path calls usb_unanchor_urb() before urb->complete(), so an URB

resubmitted from its own completion handler is off the anchor. The

capture URBs are anchored once, at stream start, so from the first

completion onward tascam->capture_anchor is empty.

tascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the

stop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor)

to reap the capture URBs before anything is freed. With the anchor empty

those calls return immediately and the URBs stay queued on the host

controller.

tascam_free_urbs() then returns the capture transfer buffers with

usb_free_coherent(), and snd_card_free() releases the snd_ca

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References