Memory Management Flaw in USB 6fire Driver Found in Linux Kernel

CVE-2026-98428

What is CVE-2026-98428?

A programming flaw in the USB 6fire driver within the Linux kernel related to the management of embedded URBs can lead to a use-after-free vulnerability. This arises due to a buggy implementation when managing USB Request Blocks (URBs) linked with PCM and MIDI communication. Typically, when a URB is released asynchronously, it can still be accessed by the system, resulting in unpredictable behavior. To mitigate this issue, the driver has been updated to utilize properly allocated URBs through the usb_alloc_urb() function, ensuring that resources are managed effectively without functional changes in operation.

References