CVE-2026-64491: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64491 Overview

CVE-2026-64491 is a use-after-free (UAF) vulnerability in the Linux kernel's ALSA usx2y driver for the Tascam US-144MKII USB audio interface. The flaw exists in the tascam_disconnect() routine, which cancels capture_work and midi_in_work before calling usb_kill_anchored_urbs(). A race window allows a self-resubmitting URB to complete between cancel_work_sync() and usb_kill_anchored_urbs(), re-arming the work after its only cancel. The work handler then executes against memory freed by snd_card_free().

Critical Impact
A physical USB device disconnect can trigger a use-after-free on the card-private tascam structure, potentially leading to kernel memory corruption or local denial of service.

Affected Products

Linux kernel — ALSA snd-usb-usx2y driver (Tascam US-144MKII support)
Stable kernel branches receiving the fix in commits 147996e, 27161c6, and c071df0
Systems with the Tascam US-144MKII USB audio interface connected

Discovery Timeline

2026-07-25 - CVE-2026-64491 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64491

Vulnerability Analysis

The vulnerability resides in the Tascam US-144MKII disconnect handler within the ALSA usx2y USB driver. On device removal, tascam_disconnect() performs cleanup in an unsafe order: it cancels the deferred capture_work and midi_in_work items first, then kills the anchored capture and MIDI-in URBs. Because these URBs self-resubmit, and their completion handlers reschedule the corresponding work items, a URB that completes in the narrow window after cancel_work_sync() but before usb_kill_anchored_urbs() re-arms the work with no subsequent cancel to stop it.

Once snd_card_free() releases the card-private tascam structure, the re-armed work handler runs against freed memory. This produces a classic kernel use-after-free with potential for memory corruption or an exploitable read/write primitive depending on allocator state.

Root Cause

The root cause is an incorrect teardown ordering between deferred work cancellation and URB termination. The driver cancels work items whose completion handlers can be triggered by still-live, self-resubmitting URBs, leaving a race window where cancelled work can be re-armed against a structure that is about to be freed.

Attack Vector

Triggering the flaw requires a USB disconnect event while the Tascam US-144MKII device is active with in-flight capture or MIDI-in URBs. The vector is local and physical: an attacker with USB access, or a scripted disconnect via usbip or authorized device removal, can time the disconnect to hit the race window. Remote exploitation is not applicable without prior local access to the audio device.

No public proof-of-concept has been disclosed. The upstream fix reorders the teardown so anchored URBs are killed before the work items are cancelled, closing the re-arm window.

Detection Methods for CVE-2026-64491

Indicators of Compromise

Kernel oops or KASAN: use-after-free reports referencing snd-usb-usx2y, tascam_disconnect, capture_work, or midi_in_work.
Unexpected kernel panics or module faults correlated with USB disconnect events for Tascam US-144MKII devices (USB vendor/product identifiers for Tascam US-144MKII).
dmesg entries showing work-queue callbacks executing after snd_card_free().

Detection Strategies

Enable KASAN in test kernels to surface UAF conditions in the usx2y driver during disconnect stress testing.
Monitor kernel logs for repeated crashes tied to USB audio device removal events on affected kernel versions.
Inventory endpoints with the snd-usb-usx2y module loaded and cross-reference against unpatched kernel builds.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized log store and alert on usx2y, tascam, or KASAN strings.
Track USB attach/detach events via udev monitoring to correlate device churn with kernel faults.
Include kernel version and loaded-module telemetry in endpoint posture reports for Linux workstations that host audio hardware.

How to Mitigate CVE-2026-64491

Immediate Actions Required

Apply the upstream stable kernel updates containing commits 147996e7e7c9, 27161c68d5e7, and c071df05bcda as soon as your distribution publishes them.
Identify Linux hosts using the Tascam US-144MKII and prioritize their patching, especially multi-user or shared workstations.
If patching is delayed, unload the snd-usb-usx2y module on systems that do not require the device: modprobe -r snd-usb-usx2y.

Patch Information

The fix reorders the disconnect sequence so that usb_kill_anchored_urbs() runs before cancel_work_sync() on capture_work and midi_in_work. Once no URB can complete, the work items cannot be re-armed, eliminating the UAF window. Relevant references: Kernel Git Commit 147996e, Kernel Git Commit 27161c, and Kernel Git Commit c071df.

Workarounds

Blacklist the snd-usb-usx2y kernel module on hosts that do not need Tascam US-144MKII support.
Physically remove or restrict access to the Tascam US-144MKII device on affected systems until the kernel is patched.
Restrict physical and logical USB access to trusted users to reduce the ability to trigger the disconnect race.

bash

# Configuration example
# Blacklist the vulnerable module until the kernel is patched
echo 'blacklist snd-usb-usx2y' | sudo tee /etc/modprobe.d/blacklist-usx2y.conf
sudo modprobe -r snd-usb-usx2y
# Verify the module is not loaded
lsmod | grep usx2y