CVE-2026-74505: ALSA: 6fire: Fix UAF at error handling during probe

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: 6fire: Fix UAF at error handling during probe

Although 6fire driver had a few fixes for dealing with the early error
handling during the probe phase, it forgot a pending URB before
freeing the resources, which may lead to a UAF.

This patch addresses it by doing the almost same cleanup procedure
like the normal disconnect phase at the error path.

The Linux kernel CVE team has assigned CVE-2026-74505 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.6.151 with commit 49bc7741cd2761c703a292dc69245041ae8a67bd
	Fixed in 6.12.103 with commit 2de734dcbb210bd59983e13d36988acbcc122194
	Fixed in 6.18.44 with commit 11e2953d9f4c7c3d2af94a889c2d805c537d633f
	Fixed in 7.1.8 with commit 630c8d6a93cbd9b2a207f1a67ef1fd21af098b0c
	Fixed in 7.2-rc6 with commit a54bf16965f896415c3337bc4fbb40fb11941d99

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74505
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/usb/6fire/chip.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/49bc7741cd2761c703a292dc69245041ae8a67bd
	https://git.kernel.org/stable/c/2de734dcbb210bd59983e13d36988acbcc122194
	https://git.kernel.org/stable/c/11e2953d9f4c7c3d2af94a889c2d805c537d633f
	https://git.kernel.org/stable/c/630c8d6a93cbd9b2a207f1a67ef1fd21af098b0c
	https://git.kernel.org/stable/c/a54bf16965f896415c3337bc4fbb40fb11941d99