https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:46:06 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64491 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: usx2y: us144mkii: fix work UAF on disconnect</p> <p>tascam_disconnect() cancels capture_work and midi_in_work before usb_kill_anchored_urbs() kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule the work.</p> <p>A URB that completes in the small window between cancel_work_sync() and usb_kill_anchored_urbs() therefore re-arms the work after its only cancel. Nothing cancels it again before snd_card_free() frees the card-private tascam structure, so the work handler then runs on freed memory.</p> <p>Kill the anchored URBs before cancelling the work; once the work is cancelled no remaining URB can complete to re-arm it.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: usx2y: us144mkii: fix work UAF on disconnect</p> <p>tascam_disconnect() cancels capture_work and midi_in_work before usb_kill_anchored_urbs() kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule the work.</p> <p>A URB that completes in the small window between cancel_work_sync() and usb_kill_anchored_urbs() therefore re-arms the work after its only cancel. Nothing cancels it again before snd_card_free() frees the card-private tascam structure, so the work handler then runs on freed memory.</p> <p>Kill the anchored URBs before cancelling the work; once the work is cancelled no remaining URB can complete to re-arm it.</p> https://vulnerability.circl.lu/vuln/cve-2026-64491