The vulnerability in the Linux kernel ALSA us144mkii driver arises from a redundant usb_anchor_urb() call in the capture_urb_complete() function, which is invoked on every completion callback despite the URB already being anchored during initial submission. This redundancy corrupts the anchor's doubly-linked list and increases the URB reference count improperly. When usb_kill_anchored_urbs() later traverses this corrupted list during operations like stream stop, suspend, or disconnect, it can trigger a use-after-free condition. This flaw has been addressed by removing the redundant usb_anchor_urb() call from the resubmit path. The vulnerability is tracked as CVE-2026-64601 with a CVSS 3.1 score of 7.8 (high severity). The fix is included in updated linux-hwe-edge kernel packages for Ubuntu 24.04 LTS and related releases.

Successful exploitation of this vulnerability could lead to use-after-free conditions in the kernel, potentially allowing an attacker with local privileges to cause memory corruption. This could result in privilege escalation, denial of service, or system instability. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability.

A patch is available and has been released by Ubuntu as part of their linux-hwe-edge kernel updates. Users should apply the security updates to the linux-hwe-edge kernel packages and reboot their systems to ensure the fix is active. Due to an ABI change in the kernel update, recompilation and reinstallation of third-party kernel modules may be required. Follow the vendor advisory instructions for updating to the fixed package versions.