CVE-2026-64601: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64601 is a use-after-free vulnerability in the Linux kernel's ALSA us144mkii USB audio driver, caused by redundant usb_anchor_urb() calls in the capture_urb_complete() function. Each redundant call corrupts the anchor's doubly-linked list and inflates the URB refcount; when usb_kill_anchored_urbs() traverses the corrupted list during stream stop, suspend, or disconnect, a use-after-free condition results. The vulnerability affects Linux kernel versions starting from commit c1bb0c13e430623c26543baae5bb9ae21139db87 through kernel 6.18 (before 6.18.39) and 7.1 (before 7.1.4). It was published on August 6, 2026, with a CVSS v3.1 base score of 7.8 (High) (Github Advisory).

The root cause is improper management of USB Request Block (URB) anchoring in the ALSA us144mkii driver (CWE not formally assigned). In capture_urb_complete(), usb_anchor_urb() is called on every URB completion callback, despite the URB already being anchored during initial submission in tascam_trigger_start(). Each redundant anchoring call corrupts the doubly-linked list maintained by the USB anchor structure and artificially inflates the URB reference count. When usb_kill_anchored_urbs() later traverses this corrupted list — triggered by stream stop, system suspend, or device disconnect — it accesses already-freed memory, resulting in a use-after-free condition. The fix removes the redundant usb_anchor_urb() call from the resubmit path (Github Advisory, Kernel Patch 1).

Successful exploitation allows a local attacker with access to the ALSA us144mkii USB audio device to trigger a kernel use-after-free, potentially resulting in a kernel crash (denial of service), memory corruption, or privilege escalation. The CVSS scoring reflects high confidentiality, integrity, and availability impact, meaning an attacker could potentially read sensitive kernel memory, corrupt kernel data structures, or crash the system entirely. The attack is limited to the local system and requires low privileges, but the consequences can affect the entire operating system (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.124% (3rd percentile), indicating a low probability of exploitation in the near term. Exploitation requires local access and physical or logical access to a system with the us144mkii USB audio device attached.

Apply the Linux kernel patches that remove the redundant usb_anchor_urb() call from the capture_urb_complete() resubmit path. Fixed versions include Linux kernel 6.18.39 (for the 6.18.x stable branch), 7.1.4 (for the 7.1.x stable branch), and 7.2-rc2 or later for mainline. Users should upgrade to a patched kernel version as provided by their Linux distribution. As a temporary workaround, avoiding use of the TASCAM US-144MKII USB audio device on unpatched systems reduces exposure (Github Advisory, Kernel Patch 1, Kernel Patch 2, Kernel Patch 3).