From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794065634; b=yKrU4ZDWKTvi2HR30YY0rhWax4OCK+08hxhKKzbo3fQcsdCWb0u78CyvO3T5FvSOA9kL HHQCFAfPWzGCaEbulXvVrCbIFGPjHBTfBL6dlFDzfnMTfvYA41x258KKBJEZJ8ZAKXM27 essW8g4YrXqEqFXMD/iIg7yXS9Wo0CnGXmpVPORKQU2vfjpumris8cQuxclO01kxrxnlP xphQj12v/wMIEnCfphbAZZHGgUumBjMzo6f/OYkmOIYeFdFcQnl/iIQJ9JJF93nF9FhZc XHtbNWurKGfJY+Xs0NzyC/Cx+U254/KnH+JSLyA5DXILxgA0YeR1myG8KZH0PYdqBmg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794065634; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: Reply-To:MIME-Version:Lines:X-Developer-Signature:X-Developer-Key: Content-Transfer-Encoding; bh=aB4TIn+6x0dVbuT1IhaHmEYfo/56koSUukAC0vS8GLo=; b=a5/oTiIHv9JWAJoSN+3xnQ9XeusUj0zT8QTz9fzdGXIxvMNRw2HknP0O3R5jHbycFbYR 18ld3PDSUajnjjWm/pqQ6/1+DW9AVYF2WoOxItdxxB3TLWIktr4rmJA1cAmk3OvD1boRk rM5fbEvlHSZSAfrR3SrKwgBwMN3TA3OuJYsLGqWweGoazWWLhO1W3I44YvtjsSm2C6YZs h6VNy1DlxLYjZjPuFVK740d5MQKWWZV/XbrBtkNARfxNjmemnwmF4XSfRjab75Ly+lWNA Ky/1d/EjfFdinYxP1m/Azqrmu6Jvc2wHfd3asCSrICJc4A/gRjbc33t2QGd0QZ8e6Rg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=1t8NUA3h; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 34741606D802 for ; Sat, 7 Nov 2026 15:33:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=1t8NUA3h Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9226D1F0089F; Sat, 7 Nov 2026 15:33:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794065633; bh=aB4TIn+6x0dVbuT1IhaHmEYfo/56koSUukAC0vS8GLo=; h=From:To:Cc:Subject:Date:Reply-To; b=1t8NUA3hAsCzvKxKGEoGecSUW1Jz66Si8hjT5YKJjlknDAyItUIIn9Mn7+27u9cuh q2fseDNwLGBsDNY6DNw+HZJpJlrTpycfX7McD4cqOWVGvfvGWznmVxsTNAVufMKQkk NZWr1fNyAlm3WAHaHmc2SUfQoW+qdG7TQlcAsAbU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-99271: ALSA: line6: Clear prev_fbuf on capture buffer release Date: Sat, 7 Nov 2026 09:08:51 -0500 Message-ID: <2026110751-CVE-2026-99271-e93e@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3845; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=auai3lK6/KqkQRQRuzVya2a3iH2lqhyrZsKL/m0SJmM=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnvDT77Cid5dsszbuWo/CY1z177kpovq4JE9dSXKakz9 Lyq9vt2xLIwCDIxyIopsnzZxnN0f8UhRS9D29Mwc1iZQIYwcHEKwEQWNDHMYjLd3npf4OaL5rAr b1f9uMPX9LNSkWF+9e79rCe7Z7Uc4Hxxuuzu8jnREX+LAQ== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prev_fbuf on capture buffer release A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal: BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline] BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249 Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785 Allocated by task 11: kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144 line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158 line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329 line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728 Freed by task 7785: kfree+0xf8/0x390 mm/slub.c:6566 line6_buffer_release sound/usb/line6/pcm.c:176 [inline] line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170 __line6_pcm_release sound/usb/line6/pcm.c:305 [inline] line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313 snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183 line6pcm->prev_fbuf points into the capture PCM stream buffer (line6pcm->in.buffer), which is updated during audio_in_callback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side. When all capture streams are closed, line6_buffer_release() frees pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf. If playback is subsequently started (e.g. via impulse test signal volume control snd_line6_impulse_volume_put()), submit_audio_out_urb() dereferences the stale pointer line6pcm->prev_fbuf under in.lock, resulting in a slab-use-after-free read. Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submit_audio_out_urb(). The Linux kernel CVE team has assigned CVE-2026-99271 to this issue. Affected and fixed versions =========================== Issue introduced in 4.0 with commit 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 and fixed in 6.18.61 with commit 862d9268f40a6e10cef24eb226e738fb69ce8aa7 Issue introduced in 4.0 with commit 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 and fixed in 7.3.2 with commit 22c82f33ff0b68d37041adf1dea5533a5863cd31 Issue introduced in 4.0 with commit 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 and fixed in 7.4-rc1 with commit aa118c8f61d59387961d58ffae831c5259a9f222 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-99271 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: sound/usb/line6/pcm.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/862d9268f40a6e10cef24eb226e738fb69ce8aa7 https://git.kernel.org/stable/c/22c82f33ff0b68d37041adf1dea5533a5863cd31 https://git.kernel.org/stable/c/aa118c8f61d59387961d58ffae831c5259a9f222