CVE-2026-74639

UNRATEDCVSS · not yet scoredTrending — 3 sources updated this week
—
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • No CVSS published and no exploitation signals yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS v2: —Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

ALSA: us144mkii: re-anchor capture URBs on resubmission

capture_urb_complete() resubmits each capture URB without anchoring it:

usb_get_urb(urb); ret = usb_submit_urb(urb, GFP_ATOMIC);

Anchoring is a property of a submission, not of the URB. The giveback path calls usb_unanchor_urb() before urb->complete(), so an URB resubmitted from its own completion handler is off the anchor. The capture URBs are anchored once, at stream start, so from the first completion onward tascam->capture_anchor is empty.

tascam_free_urbs(), tascam_disconnect(), tascam_suspend() and the stop-work path all call usb_kill_anchored_urbs(&tascam->capture_anchor) to reap the capture URBs before anything is freed. With the anchor empty those calls return immediately and the URBs stay queued on the host controller.

tascam_free_urbs() then returns the capture transfer buffers with usb_free_coherent(), and snd_card_free() releases the snd_card allocation that embeds tascam (card->private_data). The controller completes the queued URBs afterwards, writing device-supplied data into the freed transfer buffer, and capture_urb_complete() dereferences the freed driver object.

KASAN on 7.2.0-rc5 (arm64):

BUG: KASAN: slab-use-after-free in dummy_timer Write of size 512 at addr ffff000015b62000 __asan_memcpy dummy_timer hrtimer_run_softirq Allocated by task 64: usb_alloc_coherent tascam_alloc_urbs tascam_probe Freed by task 170: usb_free_coherent tascam_free_urbs tascam_disconnect usb_unbind_interface

BUG: KASAN: slab-use-after-free in capture_urb_complete Read of size 4 at addr ffff0000170ee878 Freed by task 170: release_card_device snd_card_free tascam_disconnect

Restore the usb_anchor_urb() between the reference count bump and the resubmission. That also makes the handler's usb_unanchor_urb() failure arm meaningful again and restores usb_kill_anchored_urbs() as a barrier on the disconnect, suspend and stop-work paths.

The anchoring was removed on the premise that the URB is already anchored from the initial submission, which does not hold once the first giveback has run.

Discovered by XBOW, triaged by Baul Lee

CVSS v3
—
EchelonGraph score
Not yet assessedNo source has published severity data for this CVE yet — no CVSS score from NVD or a CNA, no GitHub advisory, and it is not in CISA KEV. This is not a rating of zero; we cannot assess it yet.
EG Score
—
EG Risk
—
EPSS PROB
0%
EPSS %ILE
6%
KEV
Not listed

Published

August 22, 2026

Last Modified

August 22, 2026

References (3)

Vendor Advisories for CVE-2026-74639(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Data Freshness Timeline

(refreshed 9× in last 7d / 12× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-30 01:22 UTCEPSS rescore
  2. 2026-08-29 00:52 UTCGHSA enrichment
  3. 2026-08-28 21:42 UTCEPSS rescore
  4. 2026-08-27 14:25 UTCEPSS rescore
  5. 2026-08-26 14:47 UTCEPSS rescore
  6. 2026-08-25 19:23 UTCEG score recompute
  7. 2026-08-25 19:23 UTCGHSA enrichment
  8. 2026-08-25 13:49 UTCEPSS rescore
  9. 2026-08-24 14:18 UTCEPSS rescore
  10. 2026-08-22 16:24 UTCNVD update
  11. 2026-08-22 15:41 UTCEG score recompute
  12. 2026-08-22 15:35 UTCMITRE cvelistV5first tracked

Frequently asked(4)

What is CVE-2026-74639?
CVE-2026-74639 is a publicly disclosed vulnerability published on August 22, 2026. In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete() resubmits each capture URB without anchoring it: usbgeturb(urb); ret = usbsubmiturb(urb, GFP_ATOMIC); Anchoring is a property of a submission, not of the…
When was CVE-2026-74639 disclosed?
CVE-2026-74639 was first published in the National Vulnerability Database on August 22, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-74639 actively exploited?
CVE-2026-74639 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 93.9% of all scored CVEs.
How do I remediate CVE-2026-74639?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-74639, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-74639

Explore →

Is Your Infrastructure Affected by CVE-2026-74639?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs