CVE-2026-64601 Overview
CVE-2026-64601 is a use-after-free vulnerability in the Linux kernel's ALSA driver for the TASCAM US-144MKII USB audio interface. The flaw resides in the capture_urb_complete() function of the us144mkii driver. The completion callback calls usb_anchor_urb() on every URB resubmission, even though the URB was already anchored during initial submission in tascam_trigger_start(). Each redundant anchor operation corrupts the doubly-linked anchor list and inflates the URB reference count. When usb_kill_anchored_urbs() later traverses the corrupted list during stream stop, suspend, or device disconnect, the driver dereferences freed memory.
Critical Impact
Local attackers with a connected TASCAM US-144MKII device can trigger kernel memory corruption leading to use-after-free, potentially resulting in denial of service or local privilege escalation.
Affected Products
- Linux kernel versions containing the us144mkii ALSA driver
- Systems with the TASCAM US-144MKII USB audio interface driver enabled
- Stable kernel branches referenced by commits 16f14f5, 5cff152, and ab1db64
Discovery Timeline
- 2026-08-06 - CVE-2026-64601 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-64601
Vulnerability Analysis
The vulnerability affects the USB Request Block (URB) lifecycle management inside the us144mkii audio capture path. The Linux USB subsystem uses anchor objects to track submitted URBs, allowing bulk cancellation through usb_kill_anchored_urbs(). Each URB should appear exactly once in an anchor's doubly-linked list.
In the affected driver, tascam_trigger_start() correctly anchors each capture URB during initial submission. However, the completion handler capture_urb_complete() calls usb_anchor_urb() again on every resubmission cycle. Because the URB is already linked into the anchor list, the redundant call corrupts list pointers and increments the URB reference count beyond expected bounds.
Root Cause
The root cause is redundant URB anchoring in the completion callback path. The usb_anchor_urb() API assumes the URB is not currently anchored. Re-anchoring an already-anchored URB manipulates list_head pointers unsafely and inflates the kref counter, leaving the anchor structure in an inconsistent state.
Attack Vector
Exploitation requires a TASCAM US-144MKII device connected to the target system, or a suitable USB gadget emulating this device. An attacker triggers audio capture start, then forces a stream stop, system suspend, or device disconnect. During teardown, usb_kill_anchored_urbs() walks the corrupted anchor list and operates on freed URB memory, producing a use-after-free condition inside kernel context.
The upstream fix removes the redundant usb_anchor_urb() call from the resubmit path in capture_urb_complete(), restoring correct single-anchor semantics. See the Kernel Git Commit 16f14f5 for the exact patch.
Detection Methods for CVE-2026-64601
Indicators of Compromise
- Kernel oops or panic messages referencing usb_kill_anchored_urbs, capture_urb_complete, or the snd_usb_us144mkii module
- Slab corruption warnings from KASAN identifying use-after-free reads in URB structures
- Unexpected system crashes correlated with USB audio device disconnect or system suspend events
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test kernels to surface the use-after-free during audio capture teardown
- Monitor dmesg and journal logs for repeated warnings involving the us144mkii driver during stream stop and USB disconnect operations
- Audit loaded kernel modules using lsmod | grep us144mkii to identify systems where the vulnerable code path is reachable
Monitoring Recommendations
- Track kernel crash telemetry and correlate stack traces containing usb_anchor_urb and capture_urb_complete frames
- Alert on unplanned reboots of workstations with connected USB audio interfaces
- Collect and centralize kernel logs in a SIEM to detect repeated URB-related fault patterns across the fleet
How to Mitigate CVE-2026-64601
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable git commits 16f14f5, 5cff152, and ab1db64
- Update to a distribution kernel that includes the fix and reboot affected systems
- Restrict physical USB access on systems where the us144mkii driver is loaded and the kernel is not yet patched
Patch Information
The fix removes the redundant usb_anchor_urb() call from the URB resubmission path in capture_urb_complete(). Three stable kernel commits deliver the correction: Kernel Git Commit 16f14f5, Kernel Git Commit 5cff152, and Kernel Git Commit ab1db64. Consult your distribution's security advisories for the specific package version containing the backport.
Workarounds
- Blacklist the snd_usb_us144mkii module on systems that do not require TASCAM US-144MKII audio functionality
- Physically disconnect TASCAM US-144MKII devices until the kernel is patched
- Disable USB audio class loading via udev rules on hardened endpoints where USB audio is not a business requirement
# Blacklist the vulnerable driver until the kernel is patched
echo "blacklist snd_usb_us144mkii" | sudo tee /etc/modprobe.d/blacklist-us144mkii.conf
sudo rmmod snd_usb_us144mkii 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
