---
id: CVE-2026-98428
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: usb: 6fire: Avoid embedded URBs

  The USB 6fire driver uses URBs embedded in different structs for PCM,
  MIDI and communication, and this is basically a buggy imple…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ALSA: usb: 6fire: Avoid embedded URBs

  The USB 6fire driver uses URBs embedded in different structs for PCM,
  MIDI and communication, and this is basically a buggy imple…
severity: none
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T14:17:54.460'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98428'
references:
  - url: 'https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:13.991Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb: 6fire: Avoid embedded URBs

The USB 6fire driver uses URBs embedded in different structs for PCM,
MIDI and communication, and this is basically a buggy implementation
nowadays; since a URB is managed with a refcount, this may lead to a
UAF when the URB is released asynchronously.

For addressing the problem, this patch converts those embedded URBs to
ones that are properly allocated via usb_alloc_urb().  The
pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence
it's found in urb.iso_frame_desc[] instead.

The conversions are rather straightforward; each embedded struct urb
is changed to a pointer, and its callers are updated accordingly.
The resource for those structs are released in the common destructor
functions (usb6fire_comm_free(), etc), which are called at both the
init error path and the disconnect.

No functional changes, only compile-tested.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.