The vulnerability in the Linux kernel ALSA us144mkii driver arises because capture URBs are resubmitted in the capture_urb_complete() function without re-anchoring them. Anchoring is a submission property that ensures URBs can be properly tracked and killed on disconnect or suspend. Since the URBs are only anchored once at stream start, subsequent resubmissions are off-anchor, causing calls to usb_kill_anchored_urbs() to return immediately without reaping the URBs. When the driver frees the transfer buffers and associated structures, the USB host controller may still complete queued URBs, writing data into freed memory and causing use-after-free conditions. The fix restores usb_anchor_urb() calls between reference count increment and resubmission, ensuring proper anchoring and safe cleanup. This vulnerability was discovered by XBOW and triaged by Baul Lee.

This vulnerability can lead to use-after-free conditions in kernel memory, potentially causing kernel crashes or memory corruption. The device can write data into freed memory buffers, which may destabilize the kernel or lead to undefined behavior. No known exploits in the wild have been reported.

A fix is available and has been applied to the Linux kernel to restore proper anchoring of URBs on resubmission in the ALSA us144mkii driver. Users should update to a kernel version that includes this patch. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation.