Use-After-Free Vulnerability in Linux Kernel Affects Audio Device Driver

CVE-2026-64491

What is CVE-2026-64491?

A vulnerability in the ALSA usx2y driver of the Linux kernel can lead to a use-after-free condition. This occurs when the function tascam_disconnect() attempts to cancel ongoing work before terminating USB requests. If a USB request block (URB) completes during a specific timing window, it can inadvertently reinitialize the work after it has been canceled. Consequently, the work handler may execute using freed memory, potentially allowing for unauthorized access or system instability. To mitigate this issue, the driver code has been updated to ensure that all URBs are properly terminated before canceling any work.

References