CVE-2026-99271

Unknown

Published: 07/11/2026(UTC)Translated: 07/11/2026(UTC)NVD NIST

Summary

A use-after-free vulnerability exists in the Linux kernel ALSA line6 driver. line6_buffer_release() frees the capture stream buffer but does not clear the line6pcm->prev_fbuf pointer, which is later dereferenced in submit_audio_out_urb() during playback, causing a slab-use-after-free read.

Risk Assessment

The flaw can be exploited to crash the kernel (denial of service) or potentially leak data from freed memory. It affects systems with USB devices handled by the line6 driver (e.g., Line6 audio interfaces).

Recommendation

Update the Linux kernel to a version containing the fix (commit clearing prev_fbuf and prev_fsize in line6_buffer_release). If updating is not possible, restrict access to line6 devices or avoid closing capture streams while starting playback.

Other vulnerabilities in Linux kernel ALSA line6 driver

CVE-2026-98836Low risk· EPSS 6%
In the Linux kernel ALSA line6 driver (sound/usb/line6/playback.c), the number of bytes written into a playback URB buffer slice was never validated against the slice size. When a USB device declares a large IN wMaxPacketSize and a small OUT wMaxPacketSize, submit_audio_out_urb() performs a memcpy()/memset() beyond the allocated region, causing a slab-out-of-bounds write.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prev_fbuf on capture buffer release A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal: BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline] BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249 Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785 Allocated by task 11: kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144 line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158 line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329 line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728 Freed by task 7785: kfree+0xf8/0x390 mm/slub.c:6566 line6_buffer_release sound/usb/line6/pcm.c:176 [inline] line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170 __line6_pcm_release sound/usb/line6/pcm.c:305 [inline] line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313 snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183 line6pcm->prev_fbuf points into the capture PCM stream buffer (line6pcm->in.buffer), which is updated during audio_in_callback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side. When all capture streams are closed, line6_buffer_release() frees pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf. If playback is subsequently started (e.g. via impulse test signal volume control snd_line6_impulse_volume_put()), submit_audio_out_urb() dereferences the stale pointer line6pcm->prev_fbuf under in.lock, resulting in a slab-use-after-free read. Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submit_audio_out_urb().

Vulnerability data from NVD (NIST) · CISA KEV · EPSS