{"id":"CVE-2026-99271","kind":"vulnerability","aliases":["CVE-2026-99271"],"related":[],"title":"Linux kernel: line6 audio driver reads freed memory during impulse test","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: Clear prev_fbuf on capture buffer release\n\nA KASAN slab-use-after-free read was reported in submit_audio_out_urb()\nwhen generating an impulse test signal:\n\n  BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]\n  BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249\n  Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785\n\n  Allocated by task 11:\n   kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144\n   line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158\n   line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329\n   line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728\n\n  Freed by task 7785:\n   kfree+0xf8/0x390 mm/slub.c:6566\n   line6_buffer_release sound/usb/line6/pcm.c:176 [inline]\n   line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170\n   __line6_pcm_release sound/usb/line6/pcm.c:305 [inline]\n   line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313\n   snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183\n\nline6pcm->prev_fbuf points into the capture PCM stream buffer\n(line6pcm->in.buffer), which is updated during audio_in_callback() to\nfeed rate synchronization, software monitoring, and impulse test signal\ngeneration on playback side.\n\nWhen all capture streams are closed, line6_buffer_release() frees\npstr->buffer with kfree().  However, it does not clear line6pcm->prev_fbuf.\nIf playback is subsequently started (e.g. via impulse test signal\nvolume control snd_line6_impulse_volume_put()), submit_audio_out_urb()\ndereferences the stale pointer line6pcm->prev_fbuf under in.lock,\nresulting in a slab-use-after-free read.\n\nClear prev_fbuf and prev_fsize in line6_buffer_release() when releasing\nthe capture stream buffer under in.lock, ensuring that no stale buffer\npointer can be accessed by submit_audio_out_urb().","summary":"The Linux kernel's line6 USB audio driver keeps a pointer to a capture buffer after that buffer is freed, so playback can read freed memory. An attacker who can trigger playback on a connected line6 device may read kernel memory in a use-after-free.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alsa","line6","linux-kernel","runtime","usb-audio"],"not_affected_if":["line6-driver-not-loaded","no-line6-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","triaged_at":"2026-11-07T14:49:58+00:00","updated_at":"2026-11-07T14:49:58+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-07T14:49:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: line6 audio driver reads freed memory during impulse test","impact":"medium","summary":"The Linux kernel's line6 USB audio driver keeps a pointer to a capture buffer after that buffer is freed, so playback can read freed memory. An attacker who can trigger playback on a connected line6 device may read kernel memory in a use-after-free.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","alsa","usb-audio","line6"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kernel memory read through a freed buffer pointer","analyst_note":"Find the affected and fixed kernel versions and the upstream commit in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-99271.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["line6-driver-not-loaded","no-line6-hardware"],"who_is_affected":"Affects Linux systems with the line6 ALSA USB audio driver loaded and in use, such as those with Line 6 USB audio interfaces. Systems without line6 hardware or with the driver not loaded are unlikely to be exposed. The sources do not say which kernel versions are affected or fixed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000763,"input_tokens":5049,"output_tokens":517,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':141C,163C,170C,177C,184C,193C,206C,219C,227C '-2026':13A,16A '-99271':14A,17A '11':158C '158':173C '170':209C '176':201C '183':230C '2':148C '249':144C '305':214C '313':222C '329':180C '4144':166C '6566':196C '728':187C '76':127C '7785':191C 'access':351C 'acquir':169C,176C 'addr':150C 'alloc':155C,161C 'alsa':18B,84C 'attack':54B 'audio':4A,26B,33B,105C,138C,247C,304C,354C 'buffer':41B,44B,91C,168C,198C,204C,240C,271C,275C,333C,340C,347C 'bug':114C,129C 'cach':160C 'callback':249C 'captur':40B,90C,237C,266C,338C 'clear':86C,282C,325C 'close':269C 'connect':61B 'control':297C 'creat':122C 'cve':12A,15A 'derefer':307C 'devic':63B 'driver':5A,34B 'e.g':291C 'ensur':343C 'fbuf':88C,233C,285C,313C,327C 'feed':251C 'ffff888008d74870':151C 'follow':79C 'free':73B,99C,120C,135C,273C,323C 'freed':7A,46B,51B,188C 'fsize':330C 'generat':109C,260C 'howev':278C 'impuls':10A,111C,123C,257C,293C,300C 'in.buffer':242C 'in.lock':315C,342C 'inlin':128C,202C,215C 'kasan':94C,115C,130C 'keep':35B 'kernel':2A,22B,29B,66B,77C 'kfree':192C,277C 'kmem':159C 'line6':3A,19B,31B,62B,85C,167C,174C,181C,197C,203C,210C,216C,270C,299C,332C 'line6pcm':231C,241C,283C,311C 'linux':1A,21B,28B,76C 'linux-kernel':20B 'may':64B 'memori':8A,52B,67B 'mm/slub.c':165C,195C 'monitor':225C,255C 'noprof':162C 'pcm':175C,211C,217C,238C 'playback':48B,58B,262C,287C 'point':234C 'pointer':37B,310C,348C 'prev':87C,232C,284C,312C,326C,329C 'pstr':274C 'put':226C,302C 'rate':252C 'read':6A,50B,65B,100C,145C,324C 'releas':92C,199C,205C,212C,218C,272C,334C,336C 'report':102C 'resolv':83C 'result':316C 'runtim':23B 'side':263C 'signal':113C,125C,259C,295C 'size':147C 'slab':96C,117C,132C,320C 'slab-use-after-fre':95C,116C,131C,319C 'snd':223C,298C 'softwar':254C 'sound/usb/line6/driver.c':186C 'sound/usb/line6/pcm.c':172C,179C,200C,208C,213C,221C 'sound/usb/line6/playback.c':126C,143C 'sound/usb/line6/toneport.c':229C 'stale':309C,346C 'start':290C 'startup':182C 'stream':239C,267C,339C 'submit':104C,137C,303C,353C 'subsequ':289C 'synchron':253C 'syz.2.3214/7785':154C 'task':153C,157C,190C 'test':11A,112C,124C,258C,294C 'toneport':224C 'trigger':57B 'updat':245C 'urb':107C,140C,306C,356C 'usb':25B,32B 'usb-audio':24B 'use':71B,97C,118C,133C,321C 'use-after-fre':70B 'via':292C 'volum':296C,301C 'vulner':80C 'work':183C 'x11b/0x190':228C 'x1848/0x1b20':142C 'x1a1/0x220':171C 'x2f0/0x390':164C 'x3c/0x50':185C 'x5a/0x80':220C 'xa5/0xf0':207C 'xb6/0x230':178C 'xf8/0x390':194C","nicknames":[],"mitigations":[],"who_affected":"Affects Linux systems with the line6 ALSA USB audio driver loaded and in use, such as those with Line 6 USB audio interfaces. Systems without line6 hardware or with the driver not loaded are unlikely to be exposed. The sources do not say which kernel versions are affected or fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["alsa","line6","linuxkernel","runtime","unknown","usbaudio"],"campaign_type":null,"search_a":"'-2026':13A,16A '-99271':14A,17A 'audio':4A 'cve':12A,15A 'driver':5A 'freed':7A 'impuls':10A 'kernel':2A 'line6':3A 'linux':1A 'memori':8A 'read':6A 'test':11A","search_b":"'alsa':18B 'attack':54B 'audio':26B,33B 'buffer':41B,44B 'captur':40B 'connect':61B 'devic':63B 'driver':34B 'free':73B 'freed':46B,51B 'keep':35B 'kernel':22B,29B,66B 'line6':19B,31B,62B 'linux':21B,28B 'linux-kernel':20B 'may':64B 'memori':52B,67B 'playback':48B,58B 'pointer':37B 'read':50B,65B 'runtim':23B 'trigger':57B 'usb':25B,32B 'usb-audio':24B 'use':71B 'use-after-fre':70B","search_c":"'+0':141C,163C,170C,177C,184C,193C,206C,219C,227C '11':158C '158':173C '170':209C '176':201C '183':230C '2':148C '249':144C '305':214C '313':222C '329':180C '4144':166C '6566':196C '728':187C '76':127C '7785':191C 'access':351C 'acquir':169C,176C 'addr':150C 'alloc':155C,161C 'alsa':84C 'audio':105C,138C,247C,304C,354C 'buffer':91C,168C,198C,204C,240C,271C,275C,333C,340C,347C 'bug':114C,129C 'cach':160C 'callback':249C 'captur':90C,237C,266C,338C 'clear':86C,282C,325C 'close':269C 'control':297C 'creat':122C 'derefer':307C 'e.g':291C 'ensur':343C 'fbuf':88C,233C,285C,313C,327C 'feed':251C 'ffff888008d74870':151C 'follow':79C 'free':99C,120C,135C,273C,323C 'freed':188C 'fsize':330C 'generat':109C,260C 'howev':278C 'impuls':111C,123C,257C,293C,300C 'in.buffer':242C 'in.lock':315C,342C 'inlin':128C,202C,215C 'kasan':94C,115C,130C 'kernel':77C 'kfree':192C,277C 'kmem':159C 'line6':85C,167C,174C,181C,197C,203C,210C,216C,270C,299C,332C 'line6pcm':231C,241C,283C,311C 'linux':76C 'mm/slub.c':165C,195C 'monitor':225C,255C 'noprof':162C 'pcm':175C,211C,217C,238C 'playback':262C,287C 'point':234C 'pointer':310C,348C 'prev':87C,232C,284C,312C,326C,329C 'pstr':274C 'put':226C,302C 'rate':252C 'read':100C,145C,324C 'releas':92C,199C,205C,212C,218C,272C,334C,336C 'report':102C 'resolv':83C 'result':316C 'side':263C 'signal':113C,125C,259C,295C 'size':147C 'slab':96C,117C,132C,320C 'slab-use-after-fre':95C,116C,131C,319C 'snd':223C,298C 'softwar':254C 'sound/usb/line6/driver.c':186C 'sound/usb/line6/pcm.c':172C,179C,200C,208C,213C,221C 'sound/usb/line6/playback.c':126C,143C 'sound/usb/line6/toneport.c':229C 'stale':309C,346C 'start':290C 'startup':182C 'stream':239C,267C,339C 'submit':104C,137C,303C,353C 'subsequ':289C 'synchron':253C 'syz.2.3214/7785':154C 'task':153C,157C,190C 'test':112C,124C,258C,294C 'toneport':224C 'updat':245C 'urb':107C,140C,306C,356C 'use':97C,118C,133C,321C 'via':292C 'volum':296C,301C 'vulner':80C 'work':183C 'x11b/0x190':228C 'x1848/0x1b20':142C 'x1a1/0x220':171C 'x2f0/0x390':164C 'x3c/0x50':185C 'x5a/0x80':220C 'xa5/0xf0':207C 'xb6/0x230':178C 'xf8/0x390':194C","first_public_at":"2026-11-07T14:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99271","severity":null,"published_at":"2026-11-07T14:17:02+00:00","modified_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","fetched_at":"2026-11-07T14:47:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}