ALSA: 6fire: fix use-after-free on disconnect

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory. Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 Fix by moving the card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never accessed after the card may be freed.

Timeline

1. Apr 24, 2026, 2:42 PM UTCCVE published
2. Jun 14, 2026, 5:42 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 5.10.231 · fixed in 5.10.258; From 5.15.174 · fixed in 5.15.209; From 6.1.120 · fixed in 6.1.175; From 6.6.64 · fixed in 6.6.136; From 6.12.2 · fixed in 6.12.83; From 4.19.325 · fixed in 4.20; From 5.4.287 · fixed in 5.5; From 6.11.11 · fixed in 6.12

• Linux Linux

  6.13

References 9