CVE-2026-99271— ALSA: line6: Clear prev_fbuf on capture buffer release
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： ALSA: line6：在释放捕获缓冲区时清除 prev_fbuf 在生成脉冲测试信号时，submit_audio_out_urb() 函数中报告了一起 KASAN slab-use-after-free（释放后使用）读漏洞： BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline] BUG: KASAN: slab-use-a
Possible ATT&CK Techniques 3 AI
T1069 · Permission Groups Discovery T1190 · Exploit Public-Facing Application T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-99271
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ALSA: line6: Clear prev_fbuf on capture buffer release
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: line6: Clear prev_fbuf on capture buffer release
A KASAN slab-use-after-free read was reported in submit_audio_out_urb()
when generating an impulse test signal:
BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]
BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249
Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785
Allocated by task 11:
kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144
line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158
line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329
line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728
Freed by task 7785:
kfree+0xf8/0x390 mm/slub.c:6566
line6_buffer_release sound/usb/line6/pcm.c:176 [inline]
line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170
__line6_pcm_release sound/usb/line6/pcm.c:305 [inline]
line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313
snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183
line6pcm->prev_fbuf points into the capture PCM stream buffer
(line6pcm->in.buffer), which is updated during audio_in_callback() to
feed rate synchronization, software monitoring, and impulse test signal
generation on playback side.
When all capture streams are closed, line6_buffer_release() frees
pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf.
If playback is subsequently started (e.g. via impulse test signal
volume control snd_line6_impulse_volume_put()), submit_audio_out_urb()
dereferences the stale pointer line6pcm->prev_fbuf under in.lock,
resulting in a slab-use-after-free read.
Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing
the capture stream buffer under in.lock, ensuring that no stale buffer
pointer can be accessed by submit_audio_out_urb().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-99271
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-99271
请登录查看更多情报信息。
Other References for CVE-2026-99271 (3)
Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total
| CVE-2026-99282 | net/sched: sch_teql: fix use-after-free on lower qdisc drop | |
| CVE-2026-99281 | tun: Require CAP_NET_ADMIN to attach to an ownerless device | |
| CVE-2026-99277 | ksmbd: hold a connection reference for each session channel | |
| CVE-2026-99279 | ksmbd: reclaim ended sessions on logoff and expiration | |
| CVE-2026-99278 | ksmbd: limit sessions on each connection | |
| CVE-2026-99280 | ksmbd: drain session procfs readers before dropping table references | |
| CVE-2026-99276 | ksmbd: defer connection scavenging while session locks are busy | |
| CVE-2026-99275 | smb: client: reject short SESSION_SETUP responses | |
| CVE-2026-99273 | ksmbd: reserve space for the UTF-16 terminator in stream info | |
| CVE-2026-99274 | smb: client: fix fiemap wild read on empty truncated response | |
| CVE-2026-99272 | smb: client: validate the data area in SMB2_read() |
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop -
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration -
CVE-2026-99278
ksmbd: limit sessions on each connection
Same vendor: Linux
-
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop -
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration -
CVE-2026-99278
ksmbd: limit sessions on each connection