CVE-2026-64491: ALSA: usx2y: us144mkii: fix work UAF on disconnect

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: us144mkii: fix work UAF on disconnect

tascam_disconnect() cancels capture_work and midi_in_work before
usb_kill_anchored_urbs() kills the capture/MIDI-in URBs.  Those URBs
self-resubmit, and their completion handlers reschedule the work.

A URB that completes in the small window between cancel_work_sync() and
usb_kill_anchored_urbs() therefore re-arms the work after its only
cancel.  Nothing cancels it again before snd_card_free() frees the
card-private tascam structure, so the work handler then runs on freed
memory.

Kill the anchored URBs before cancelling the work; once the work is
cancelled no remaining URB can complete to re-arm it.

The Linux kernel CVE team has assigned CVE-2026-64491 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.18 with commit c1bb0c13e430623c26543baae5bb9ae21139db87 and fixed in 6.18.39 with commit c071df05bcda0e47aac581d4b564b2bebcb1ff60
	Issue introduced in 6.18 with commit c1bb0c13e430623c26543baae5bb9ae21139db87 and fixed in 7.1.4 with commit 27161c68d5e78807c9d897db222a775b298d05fd
	Issue introduced in 6.18 with commit c1bb0c13e430623c26543baae5bb9ae21139db87 and fixed in 7.2-rc2 with commit 147996e7e7c9e8339c0e04f6fa7ccb3e4d448ff7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64491
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/usb/usx2y/us144mkii.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c071df05bcda0e47aac581d4b564b2bebcb1ff60
	https://git.kernel.org/stable/c/27161c68d5e78807c9d897db222a775b298d05fd
	https://git.kernel.org/stable/c/147996e7e7c9e8339c0e04f6fa7ccb3e4d448ff7