{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ALSA: line6: Clear prev_fbuf on capture buffer release  A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal:    BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]   BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249   Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785    Allocated by task 11:    kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144    line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158    line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329    line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728    Freed by task 7785:    kfree+0xf8/0x390 mm/slub.c:6566    line6_buffer_release sound/usb/line6/pcm.c:176 [inline]    line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170    __line6_pcm_release sound/usb/line6/pcm.c:305 [inline]    line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313    snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183  line6pcm-\u003eprev_fbuf points into the capture PCM stream buffer (line6pcm-\u003ein.buffer), which is updated during audio_in_callback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side.  When all capture streams are closed, line6_buffer_release() frees pstr-\u003ebuffer with kfree().  However, it does not clear line6pcm-\u003eprev_fbuf. If playback is subsequently started (e.g. via impulse test signal volume control snd_line6_impulse_volume_put()), submit_audio_out_urb() dereferences the stale pointer line6pcm-\u003eprev_fbuf under in.lock, resulting in a slab-use-after-free read.  Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submit_audio_out_urb().",
  "id": "DEBIAN-CVE-2026-99271",
  "modified": "2026-11-08T04:47:47.450041286Z",
  "published": "2026-11-07T14:17:02.337Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99271"
    }
  ],
  "upstream": [
    "CVE-2026-99271"
  ]
}