CVE-2026-74639 Overview
CVE-2026-74639 is a use-after-free vulnerability in the Linux kernel's ALSA us144mkii driver for TASCAM US-144MKII USB audio devices. The flaw resides in capture_urb_complete(), which resubmits capture USB Request Blocks (URBs) without re-anchoring them. Once a URB completes and gets resubmitted from its own completion handler, it is no longer tracked on tascam->capture_anchor. As a result, teardown paths that rely on usb_kill_anchored_urbs() fail to reap in-flight URBs, allowing the host controller to write into freed transfer buffers and dereference a freed driver object.
Critical Impact
The host controller writes device-supplied data into freed memory after disconnect, suspend, or stop-work, producing kernel slab use-after-free conditions confirmed by KASAN on arm64.
Affected Products
- Linux kernel ALSA snd-usb-us122l / us144mkii driver
- Systems using TASCAM US-144MKII USB audio interfaces
- Kernel versions prior to the fix commits referenced by kernel.org stable
Discovery Timeline
- Vulnerability discovered by XBOW and triaged by Baul Lee
- 2026-08-22 - CVE-2026-74639 published to NVD
- 2026-08-22 - Last updated in NVD database
Technical Details for CVE-2026-74639
Vulnerability Analysis
The us144mkii driver anchors capture URBs once at stream start using the tascam->capture_anchor anchor. During normal operation, the USB core giveback path calls usb_unanchor_urb() before invoking urb->complete(). When capture_urb_complete() resubmits the URB from within that completion handler, the URB is already off the anchor and the resubmission does not re-attach it.
From the first completion onward, tascam->capture_anchor is empty. Teardown routines including tascam_free_urbs(), tascam_disconnect(), tascam_suspend(), and the stop-work path all invoke usb_kill_anchored_urbs(&tascam->capture_anchor) to synchronously reap outstanding capture URBs. With the anchor empty, these calls return immediately while URBs remain queued on the host controller.
Root Cause
The root cause is an incorrect assumption that a single anchoring at stream start persists across URB lifetimes. Anchoring is a property of submission, not of the URB itself. Because the giveback path unanchors before the completion handler runs, the resubmission inside capture_urb_complete() requires an explicit usb_anchor_urb() call between the usb_get_urb() reference bump and the usb_submit_urb() invocation. Without it, the anchor-based reaping barrier is effectively defeated.
Attack Vector
An attacker capable of triggering device disconnect, system suspend, or the driver stop-work path while capture is active can force the driver to free transfer buffers and the embedding snd_card allocation while URBs remain live on the host controller. When those URBs complete, the controller writes device-supplied data into the freed transfer buffer and capture_urb_complete() dereferences the freed driver object. KASAN on kernel 7.2.0-rc5 arm64 reported two distinct slab-use-after-free traces: a 512-byte write in dummy_timer against memory freed by tascam_free_urbs(), and a 4-byte read in capture_urb_complete() against memory freed by snd_card_free(). Physical access to attach the USB device is generally required, but a malicious or compromised USB peripheral could shape the freed-memory contents.
No synthetic exploitation code is provided. See the Linux Kernel Commit Details for the authoritative patch.
Detection Methods for CVE-2026-74639
Indicators of Compromise
- KASAN reports of slab-use-after-free involving capture_urb_complete, dummy_timer, or tascam_free_urbs in kernel logs
- Unexpected kernel oops or panic traces on TASCAM US-144MKII disconnect or suspend events
- snd_card_free and release_card_device appearing in freed-by stack traces alongside USB URB completion frames
Detection Strategies
- Enable KASAN on test and staging kernels to surface the use-after-free deterministically during device disconnect and suspend testing
- Monitor dmesg and journald for ALSA and USB stack warnings correlated with us144mkii module load or hotplug events
- Audit installed kernel packages against distribution advisories referencing the stable commits
Monitoring Recommendations
- Collect kernel ring buffer output centrally and alert on KASAN, Oops, or general protection fault strings referencing USB audio symbols
- Track USB device attach and detach events on endpoints that use TASCAM hardware to correlate with kernel instability
- Include kernel version inventory in endpoint telemetry to identify unpatched hosts
How to Mitigate CVE-2026-74639
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by the stable tree commits 2615f0fb90df, 77792495 61d1, and a5548ce91659
- Update to a distribution kernel that incorporates the ALSA: us144mkii: re-anchor capture URBs on resubmission fix
- Restrict physical and administrative access to systems using TASCAM US-144MKII devices until patched
Patch Information
The fix restores usb_anchor_urb() between the reference count bump and the resubmission inside capture_urb_complete(). This makes the handler's usb_unanchor_urb() failure arm meaningful again and re-establishes usb_kill_anchored_urbs() as a synchronous barrier on the disconnect, suspend, and stop-work paths. Refer to the Linux Kernel Commit Overview, Linux Kernel Commit Update, and Linux Kernel Commit Details for the applied changes.
Workarounds
- Blacklist the snd-usb-us122l module on systems that do not require TASCAM US-144MKII support
- Avoid suspend and disconnect operations while capture streams are active on unpatched kernels
- Physically disconnect TASCAM US-144MKII devices when not in use to reduce exposure to the vulnerable code path
# Blacklist the vulnerable driver until patched kernels are deployed
echo 'blacklist snd-usb-us122l' | sudo tee /etc/modprobe.d/blacklist-us144mkii.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
