Linux Kernel Vulnerability in ALSA: Tascam DP-008EX

CVE-2026-64601

What is CVE-2026-64601?

In the Linux kernel's Advanced Linux Sound Architecture (ALSA), a vulnerability was identified that arises from improper handling of USB requests in the capture_urb_complete() function. The process incorrectly calls usb_anchor_urb() multiple times for a single URB, leading to corruption of the doubly-linked list associated with the URB. This redundancy inflates the reference count, resulting in potential use-after-free scenarios when operations such as stream stop, suspend, or disconnect occur. The issue has been resolved by removing the redundant calls to usb_anchor_urb() in the submission workflow, enhancing overall system reliability.

References