All vulnerabilities
CVE-2026-98837

Linux: ALSA: caiaq: unregister the input device when probe fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in850810c12686f80cdf7530f4f21e0157d904f739Also 84727facd8506140cd04f2b0a8b1c4ddeac41cea, 2e5a413cc2a489c9427ecd3d73ad764bfb0c7103 and 8 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 850810c12686f80cdf7530f4f21e0157d904f739LinuxCVE List
  • 84727facd8506140cd04f2b0a8b1c4ddeac41ceaLinuxCVE List
  • 2e5a413cc2a489c9427ecd3d73ad764bfb0c7103LinuxCVE List
  • 0b7bd20f6379bc5e431fd74d866390f5b5b63f3cLinuxCVE List
  • 6.6.160LinuxCVE List
  • 6.12.113LinuxCVE List
Show all 11 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: unregister the input device when probe fails

setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory:

BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add_uevent_var+0x183/0x3a0 input_dev_uevent+0x162/0x900 dev_uevent+0x2f1/0x870 uevent_show+0x1ca/0x3a0 ...

Unregister the input device on the probe error path, as snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when no input device was registered.

Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd_usb_caiaq_control_init() fail.

Text from CVE List

Affected versions 23

  • Linuxaffected: f537e3ad69609f6924a4db6b4a7f6561f5288bdd before df2787819bd137111b56b8631dd581b0cce7144dCVE List
  • Linuxaffected: 6251e3e256337a30160ef59ab1580dde4d1acd28 before 850810c12686f80cdf7530f4f21e0157d904f739CVE List
  • Linuxaffected: e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056 before 84727facd8506140cd04f2b0a8b1c4ddeac41ceaCVE List
  • Linuxaffected: 28abd224db4a49560b452115bca3672a20e45b2f before 2e5a413cc2a489c9427ecd3d73ad764bfb0c7103CVE List
  • Linuxaffected: 28abd224db4a49560b452115bca3672a20e45b2f before 0b7bd20f6379bc5e431fd74d866390f5b5b63f3cCVE List
  • Linuxaffected: da938aa9fc7826901921dcea225948ab21a97e45CVE List
  • Linuxaffected: 09616e25f502080ba684fc7fcf959d1376ab756dCVE List
  • Linuxaffected: b956e48371f2ff72b76be9a829800ecec963bd45CVE List
  • Linuxaffected: 096dd8519cf2f768e9e14f224b627f7aaee1a9c5CVE List
  • Linuxaffected: 6.6.140 before 6.6.160CVE List
  • Linuxaffected: 6.12.86 before 6.12.113CVE List
  • Linuxaffected: 6.18.27 before 6.18.56CVE List
  • Linuxaffected: 5.10.258 before 5.11CVE List
  • Linuxaffected: 5.15.209 before 5.16CVE List
  • Linuxaffected: 6.1.175 before 6.2CVE List
  • Linuxaffected: 7.0.4 before 7.1CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5