CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's ALSA subsystem, specifically the handling of USB audio devices, which can lead to a use-after-free condition. This flaw allows an attacker to potentially execute arbitrary code or cause a denial of service by exploiting the timing between canceling work and killing USB requests. Organizations using Linux systems with USB audio interfaces should prioritize patching this vulnerability to mitigate associated risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascam_disconnect() cancels capture_work and midi_in_work before usb_kill_anchored_urbs() kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule the work. A URB that completes in the small window between cancel_work_sync() and usb_kill_anchored_urbs() therefore re-arms the work after its only cancel. Nothing cancels it again before snd_card_free() frees the card-private tascam structure, so the work handler then runs on freed memory. Kill the anchored URBs before cancelling the work; once the work is cancelled no remaining URB can complete to re-arm it.