Answer in brief
CVE-2026-98428 records a Unknown severity vulnerability in ALSA: usb: 6fire: Avoid embedded URBs. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8b8559aeaba2e51cfee1779b2383b085991f7d81 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <52a43c2d57e774489ac3fbbac06ff02f19bd9a52 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <999f433c09e4668412bd68ca207ae2b4af863862 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d181434549b3da668110a25d743848cce9897f4e || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <9fe49dbc023e82dfaee7b245997d820d01742a9a || >=0 <6.1.189 || >=0 <6.6.158 || >=0 <6.12.112 || >=0 <6.18.54 || >=0 <7.2.8 | 3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a, 8b8559aeaba2e51cfee1779b2383b085991f7d81, 52a43c2d57e774489ac3fbbac06ff02f19bd9a52, 999f433c09e4668412bd68ca207ae2b4af863862, d181434549b3da668110a25d743848cce9897f4e, 9fe49dbc023e82dfaee7b245997d820d01742a9a, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 |
Published upstream
Oct 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 14, 2026
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence it's found in urb.iso_frame_desc[] instead. The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect. No functional changes, only compile-tested.
Quoted source text, attributed separately from HOL analysis.