From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DAFC352FE42 for ; Wed, 14 Oct 2026 13:30:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791984661; cv=none; b=RJSptqZ5TSJirTwOyApk9luUIYf8eLygZRaMKReSTksDEWEyCQA1ttznFLQVfwK9vdw10qDLZ7sUkfLn+n0va8s4a8g45EeWtm7qizR8QPQ3pTwCOmTkh3CI6e5m0+bLZ2c1rkdEQv/ggRKXr6aNd5dNS3u8F/BfmyPzWXPbuLE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791984661; c=relaxed/simple; bh=MWYW81rP8smR7EzCS7sdss+j/QhyGCoKrS3tFWkg66I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YeSA1Cfjoab1y+9F+q+mrahwgyVpIs/CTKrzmVbvouNlZh1bP+QPQRa0oUslrQs/GvQBPH0o1HB9jHhAY0vbXHvi+v0v2N9wV6rIUOSU//kHRs6/T1GqKeFVE9/Eh6wYLplPLo4XjMwlWLkB/TkQdGTL4GE/E1CvywgyQFGbp/s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=zqQ3NtNg; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="zqQ3NtNg" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C0E21F0089B; Wed, 14 Oct 2026 13:30:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791984654; bh=bZ49mh7pqvnlRTRcsN/2MXnTrL3miJyNK7NeyJuzDI0=; h=From:To:Cc:Subject:Date:Reply-To; b=zqQ3NtNggDoUEvMTtT3T97D92B56lzHoorEeTHOBlLACWpHsdi8z9TRA+9/3dhSUk 16WkQjl1tSPeWEXqRohRg2+qGeebbH7CKwIX8Q1Jit5vR7K3QwLToZcChZ3ah0+xaq q0CBHhDvQwQ2NLiMgY95POn/3n6PMv9zZFGVauG0= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98428: ALSA: usb: 6fire: Avoid embedded URBs Date: Wed, 14 Oct 2026 15:30:26 +0200 Message-ID: <2026101408-CVE-2026-98428-e3a0@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3161; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=TNYJgwHFdPpn3s7nmhgYsFhv5fVW83XwYZ3zkipF6xM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnnmx8wTrDq3V6/0s3qmWt/08pbLySXz7bs59l6Xkc71 75aIDu3I5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACYi0swwz+pG/bPMixcDTeZe 2zjpuU7pxnKpYwzzg6SrVMIzd2tUP9Q9ZXp60dLrIgvqAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence it's found in urb.iso_frame_desc[] instead. The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect. No functional changes, only compile-tested. The Linux kernel CVE team has assigned CVE-2026-98428 to this issue. Affected and fixed versions =========================== Fixed in 6.1.189 with commit 3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a Fixed in 6.6.158 with commit 8b8559aeaba2e51cfee1779b2383b085991f7d81 Fixed in 6.12.112 with commit 52a43c2d57e774489ac3fbbac06ff02f19bd9a52 Fixed in 6.18.54 with commit 999f433c09e4668412bd68ca207ae2b4af863862 Fixed in 7.2.8 with commit d181434549b3da668110a25d743848cce9897f4e Fixed in 7.3-rc3 with commit 9fe49dbc023e82dfaee7b245997d820d01742a9a Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98428 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: sound/usb/6fire/comm.c sound/usb/6fire/comm.h sound/usb/6fire/midi.c sound/usb/6fire/midi.h sound/usb/6fire/pcm.c sound/usb/6fire/pcm.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81 https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52 https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862 https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a