ALSA: usb: 6fire: Avoid embedded URBs

{
  "id": "7f6f8503d7caf0c7ef2e4cc4e9ef20ef08d4c1faf4587cb4c273e3c100f7a324",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-98428",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ALSA: usb: 6fire: Avoid embedded URBs",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence it's found in urb.iso_frame_desc[] instead. The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect. No functional changes, only compile-tested.",
    "evidence": "cve:CVE-2026-98428",
    "products": [
      {
        "name": {
          "value": "Linux",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Linux",
          "evidence": "/containers/cna/affected/1/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-98428",
      "aliases": [
        "CVE-2026-98428"
      ],
      "metrics": [],
      "affected": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "lessThan": "3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "lessThan": "8b8559aeaba2e51cfee1779b2383b085991f7d81",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "lessThan": "52a43c2d57e774489ac3fbbac06ff02f19bd9a52",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "lessThan": "999f433c09e4668412bd68ca207ae2b4af863862",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "lessThan": "d181434549b3da668110a25d743848cce9897f4e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
              "lessThan": "9fe49dbc023e82dfaee7b245997d820d01742a9a",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "sound/usb/6fire/comm.c",
            "sound/usb/6fire/comm.h",
            "sound/usb/6fire/midi.c",
            "sound/usb/6fire/midi.h",
            "sound/usb/6fire/pcm.c",
            "sound/usb/6fire/pcm.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.39",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "sound/usb/6fire/comm.c",
            "sound/usb/6fire/comm.h",
            "sound/usb/6fire/midi.c",
            "sound/usb/6fire/midi.h",
            "sound/usb/6fire/pcm.c",
            "sound/usb/6fire/pcm.h"
          ],
          "defaultStatus": "affected"
        }
      ],
      "modified": "2026-10-26T06:55:43.958Z",
      "provider": "cve",
      "references": [
        "https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a",
        "https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81",
        "https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52",
        "https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862",
        "https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e",
        "https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "shortName": "Linux",
          "dateUpdated": "2026-10-26T06:55:43.958Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-98428",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-cve",
  "document_id": 263321,
  "published_at": "2026-10-14T13:27:54.364+00:00"
}