CVE-2026-72443 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution vendors, and users of ALSA usb-audio subsystem should be aware of this vulnerability. They should assess their exposure, apply patches or updates, and monitor for suspicious USB activity. Additionally, they should implement compensating controls for ALSA usb-audio subsystem and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Linux kernel developers and maintainers should prioritize patching and backporting fixes to stable kernel versions. Linux distribution vendors should update their kernel packages and notify users about potential exposure. Users of ALSA usb-audio subsystem should ensure they have updated kernel versions and monitor for security advisories related to this vulnerability. Security teams should review compensating controls and implement additional monitoring and detection measures to identify potential exploitation attempts. Asset owners should inventory and assess Linux kernel versions for potential exposure and assign an owner for follow-up. They should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators and platform administrators should be aware of the vulnerability and its potential impact on their systems. They should review the vulnerability management process and ensure that it includes procedures for timely patching and mitigation of vulnerabilities like this one. Vulnerability management teams should review the CVE record and assess the severity of the vulnerability in their environment. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls should be reviewed and implemented for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs should be checked for exposed assets that need extra review. Source tracking and rollback/change windows should be considered for affected systems. Overall, a coordinated effort is required to address this vulnerability and minimize potential risks. This includes communication between Linux kernel maintainers, Linux,

Technical summary

The vulnerability occurs in the snd_usb_midi_v2_free() function, where endpoint storage and URB buffers are freed without stopping the submitted URBs. This can lead to a use-after-free error when the URB completion is executed. The issue arises from the asynchronous nature of USB completion and the failure path in snd_usb_midi_v2_create(). The buggy scenario involves two paths, with each column showing the order within that path: probe error path and USB completion path. The endpoint destructor follows the same teardown ordering used for disconnect when the endpoint has not already been disconnected: publish ep->disconnected, kill the URBs synchronously, and drain the endpoint before freeing URB buffers and endpoint storage. The validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in input_urb_complete+0x37/0x1b0 Workqueue: usb_hub_wq hub_event RIP: 0010:_raw_spin_unlock_irq+0x2e/0x50

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess Linux kernel versions for potential exposure
• Apply kernel updates or patches addressing this vulnerability
• Monitor for suspicious USB activity
• Implement compensating controls for ALSA usb-audio subsystem
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was observed as a KASAN slab-use-after-free in input_urb_complete(). The issue arises from the asynchronous nature of USB completion and the failure path in snd_usb_midi_v2_create().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.