https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 12:32:30 +0000 https://vulnerability.circl.lu/vuln/bell-cve-2026-98428 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://vulnerability.circl.lu/vuln/bell-cve-2026-98428 https://vulnerability.circl.lu/vuln/fkie_cve-2026-98428 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: usb: 6fire: Avoid embedded URBs</p> <p>The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously.</p> <p>For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it&#39;s allocated by usb_alloc_urb(), hence it&#39;s found in urb.iso_frame_desc[] instead.</p> <p>The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect.</p> <p>No functional changes, only compile-tested.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: usb: 6fire: Avoid embedded URBs</p> <p>The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously.</p> <p>For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it&#39;s allocated by usb_alloc_urb(), hence it&#39;s found in urb.iso_frame_desc[] instead.</p> <p>The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect.</p> <p>No functional changes, only compile-tested.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-98428 https://vulnerability.circl.lu/vuln/ghsa-xcw2-5vfj-h3fm <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: usb: 6fire: Avoid embedded URBs</p> <p>The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously.</p> <p>For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it&#39;s allocated by usb_alloc_urb(), hence it&#39;s found in urb.iso_frame_desc[] instead.</p> <p>The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect.</p> <p>No functional changes, only compile-tested.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ALSA: usb: 6fire: Avoid embedded URBs</p> <p>The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously.</p> <p>For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it&#39;s allocated by usb_alloc_urb(), hence it&#39;s found in urb.iso_frame_desc[] instead.</p> <p>The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect.</p> <p>No functional changes, only compile-tested.</p> https://vulnerability.circl.lu/vuln/ghsa-xcw2-5vfj-h3fm https://vulnerability.circl.lu/vuln/msrc_cve-2026-98428 msrc_CVE-2026-98428 https://vulnerability.circl.lu/vuln/msrc_cve-2026-98428