CVE-2026-98428 ALSA: usb: 6fire: Avoid embedded URBs
A use-after-free vulnerability in the Linux kernel USB 6fire driver allows local attackers to execute arbitrary code or escalate privileges via physical USB access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98428?
CVE-2026-98428 is an use after free vulnerability in Linux, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb: 6fire: Avoid embedded URBs
The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously.
For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence it's found in urb.iso_frame_desc[] instead.
The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect.
No functional changes, only compile-tested.
Which versions are affected by CVE-2026-98428?
How do I fix CVE-2026-98428?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98428 being exploited?
There is no known exploitation of CVE-2026-98428 in the wild and no public exploit code.
Sources
Also known as AZL-108123, BELL-CVE-2026-98428, DEBIAN-CVE-2026-98428, GHSA-xcw2-5vfj-h3fm, UBUNTU-CVE-2026-98428.