CVE-2026-99271: Linux kernel freed memory read in ALSA line6

Summary

The Linux kernel's ALSA driver for Line6 USB audio devices contains a use-after-free bug, where the playback code can read a capture buffer that has already been freed. The bug is reached through local access, since attackerPerCvssVector is not provided, and no attack details are confirmed beyond the kernel fix described.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: line6: Clear prev_fbuf on capture buffer release

A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal:

BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline] BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249 Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785

Allocated by task 11: kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144 line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158 line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329 line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728

Freed by task 7785: kfree+0xf8/0x390 mm/slub.c:6566 line6_buffer_release sound/usb/line6/pcm.c:176 [inline] line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170 __line6_pcm_release sound/usb/line6/pcm.c:305 [inline] line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313 snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183

line6pcm->prev_fbuf points into the capture PCM stream buffer (line6pcm->in.buffer), which is updated during audio_in_callback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side.

When all capture streams are closed, line6_buffer_release() frees pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf. If playback is subsequently started (e.g. via impulse test signal volume control snd_line6_impulse_volume_put()), submit_audio_out_urb() dereferences the stale pointer line6pcm->prev_fbuf under in.lock, resulting in a slab-use-after-free read.

Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submit_audio_out_urb().

cve.now Index

25Pcve.now Index 25 of 100 · methodology v3 · provisional

Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
Exposure?/25Unknown. No advisory context yet
Reach20/20Affects Linux kernel (software on nearly every server, desktop or phone)
Severity?/10Unknown. No CVSS score or vendor rating
No patch5/5No patch listed yet

What would change the score

Would score about 80 if added to CISA KEV
Would score about 75 if CISA's SSVC rates exploitation active
Would score about 47 if advisories confirm default setups are exposed

How the score works · Rankings

Timeline

Nov 7, 2026, 2:08 PM UTCCVE published
Nov 7, 2026, 2:16 PM UTCFirst seen by cve.now

Affected versions

Linux Linux
Version range not reported
Linux Linux
4.0

Evidence 3

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-99271

Is CVE-2026-99271 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by CVE-2026-99271?

Linux: version 4.0.Source: cve.now feed data