CVE Tools
Track your stack

CVE-2026-98428

ALSA: usb: 6fire: Avoid embedded URBs

No known exploitation. EPSS puts it in the 11th percentile. Fixed versions are out.

CVSS —Not scoredEPSS percentile11th0.2% chance in 30 daysCISA KEVNot listedNo confirmed exploitation
No public exploit knownFix1 product4 fixed builds listed below

Published Updated Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

  • LinuxAffected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3ef9093d83ffecb8e5f6c9d5769a52d39df74f7aUpgrade to: 3ef9093d83ffecb8e5f6c9d5769a52d39df74f7aAffected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8b8559aeaba2e51cfee1779b2383b085991f7d81Upgrade to: 8b8559aeaba2e51cfee1779b2383b085991f7d81Affected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 52a43c2d57e774489ac3fbbac06ff02f19bd9a52Upgrade to: 52a43c2d57e774489ac3fbbac06ff02f19bd9a52Affected: ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 999f433c09e4668412bd68ca207ae2b4af863862Upgrade to: 999f433c09e4668412bd68ca207ae2b4af863862 + 7 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. For addressing the problem, this patch converts those embedded URBs to ones that are properly allocated via usb_alloc_urb(). The pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence it's found in urb.iso_frame_desc[] instead. The conversions are rather straightforward; each embedded struct urb is changed to a pointer, and its callers are updated accordingly. The resource for those structs are released in the common destructor functions (usb6fire_comm_free(), etc), which are called at both the init error path and the disconnect. No functional changes, only compile-tested.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS11th
CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 11th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

4 events over 8 days, from the signal feeds we watch.

  1. OpenVAS check added
  2. Record updated
  3. Publishedrecord updated

Affected products

Sources

References in the record

And 3 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.