- —Not scoredno CVSS score yet
- 0.16%Exploitation in 30 daysEPSS · top 95% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prev_fbuf on capture buffer release A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal: BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline] BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249 Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785 Allocated by task 11: kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144 line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158 line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329 line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728 Freed by task 7785: kfree+0xf8/0x390 mm/slub.c:6566 line6_buffer_release sound/usb/line6/pcm.c:176 [inline] line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170 __line6_pcm_release sound/usb/line6/pcm.c:305 [inline] line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313 snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183 line6pcm->prev_fbuf points into the capture PCM stream buffer (line6pcm->in.buffer), which is updated during audio_in_callback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side. When all capture streams are closed, line6_buffer_release() frees pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf. If playback is subsequently started (e.g. via impulse test signal volume control snd_line6_impulse_volume_put()), submit_audio_out_urb() dereferences the stale pointer line6pcm->prev_fbuf under in.lock, resulting in a slab-use-after-free read. Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submit_audio_out_urb().
Timeline
ID reserved
By Linux
- 43 days later
· 43 days later
Published
- 3 days later
· 3 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 – < d063975ed22cdc2cb609a9828e5f658448193606
- affected 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 – < 862d9268f40a6e10cef24eb226e738fb69ce8aa7
- affected 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 – < 22c82f33ff0b68d37041adf1dea5533a5863cd31
- affected 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 – < aa118c8f61d59387961d58ffae831c5259a9f222
- affected 4.0
- unaffected < 4.0
- unaffected 6.12.117 – ≤ 6.12.*
- unaffected 6.18.61 – ≤ 6.18.*
- unaffected 7.3.2 – ≤ 7.3.*
- unaffected 7.4-rc1 – ≤ *
References
References4
- https://git.kernel.org/stable/c/d063975ed22cdc2cb609a9828e5f658448193606 (opens in a new tab)
- https://git.kernel.org/stable/c/862d9268f40a6e10cef24eb226e738fb69ce8aa7 (opens in a new tab)
- https://git.kernel.org/stable/c/22c82f33ff0b68d37041adf1dea5533a5863cd31 (opens in a new tab)
- https://git.kernel.org/stable/c/aa118c8f61d59387961d58ffae831c5259a9f222 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-119291 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99271)Record last updated .