CVE-2026-98428 is a vulnerability in Linux Kernel
Published on October 14, 2026
ALSA: usb: 6fire: Avoid embedded URBs
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb: 6fire: Avoid embedded URBs
The USB 6fire driver uses URBs embedded in different structs for PCM,
MIDI and communication, and this is basically a buggy implementation
nowadays; since a URB is managed with a refcount, this may lead to a
UAF when the URB is released asynchronously.
For addressing the problem, this patch converts those embedded URBs to
ones that are properly allocated via usb_alloc_urb(). The
pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence
it's found in urb.iso_frame_desc[] instead.
The conversions are rather straightforward; each embedded struct urb
is changed to a pointer, and its callers are updated accordingly.
The resource for those structs are released in the common destructor
functions (usb6fire_comm_free(), etc), which are called at both the
init error path and the disconnect.
No functional changes, only compile-tested.
Products Associated with CVE-2026-98428
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 8b8559aeaba2e51cfee1779b2383b085991f7d81 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 52a43c2d57e774489ac3fbbac06ff02f19bd9a52 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 999f433c09e4668412bd68ca207ae2b4af863862 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below d181434549b3da668110a25d743848cce9897f4e is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 9fe49dbc023e82dfaee7b245997d820d01742a9a is affected.
- Before 6.1.189 is affected.
- Before 6.6.158 is affected.
- Before 6.12.112 is affected.
- Before 6.18.54 is affected.
- Before 7.2.8 is affected.
- Version 6.1.189, <= 6.1.* is unaffected.
- Version 6.6.158, <= 6.6.* is unaffected.
- Version 6.12.112, <= 6.12.* is unaffected.
- Version 6.18.54, <= 6.18.* is unaffected.
- Version 7.2.8, <= 7.2.* is unaffected.
- Version 7.3-rc3, <= * is unaffected.