Linux Kernel CVE-2026-64601

The vulnerability resides in the Linux kernel's ALSA USB audio subsystem, specifically the us144mkii driver (snd-usb-usx2y) for the TASCAM US-144MKII professional USB audio interface. USB Request Blocks (URBs) are the kernel's mechanism for asynchronous USB I/O; each URB can be 'anchored' to track its lifecycle, and usb_anchor_urb() is designed to be called exactly once per submission. In tascam_trigger_start(), the URB is correctly anchored at initial submission, but the capture_urb_complete() callback - which fires on every I/O completion during streaming - redundantly calls usb_anchor_urb() again each cycle. This corrupts the anchor's internal doubly-linked list and inflates the URB's reference count with each iteration. When usb_kill_anchored_urbs() is invoked to tear down the stream (on stop, suspend, or disconnect), it walks the now-corrupted list and dereferences memory that has already been freed - a classic use-after-free condition. No CWE is formally assigned in the input data, but the root cause maps to CWE-416 (Use After Free) with elements of CWE-667 (Improper Locking / Lifecycle Management). The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers all Linux kernel versions in the affected commit range.