CVE-2026-98006 - Vulnerability Details

- ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

The epq_in_urb object belonging to the caiaq device is coupled within
the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)
executes successfully, epq_in_urb is successfully added to the urbp_list
queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD
layer driver for the caiaq USB device).

When init_card() calls snd_usb_caiaq_send_command() which subsequently
fails due to a timeout, and proceeds to call snd_card_free() to release
the card, the embedded ep1_in_urb object is also freed. When the dummy
HCD driver detects that the URB has been unlinked, it returns the URB
(by usb_hcd_giveback_urb()), which triggers [1].

Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch
to using a pointer instead. Separately allocate and manage the memory for
ep1_in_urb to prevent the release of the snd_card memory object from
interfering with it.

midi_out_urb has the same issue as ep1_in_urb and is handled in the same
way.

[1]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29
Call Trace:
usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141

Allocated by task 36:
snd_card_new+0x7b/0x110 sound/core/init.c:184
create_card sound/usb/caiaq/device.c:429 [inline]
snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544

Freed by task 36:
snd_card_free_when_closed sound/core/init.c:630 [inline]
snd_card_free+0x138/0x1d0 sound/core/init.c:662
snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553

Published: 2026-09-25

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The ALSA caiaq driver in the Linux kernel contained a use‑after‑free bug. When snd_usb_caiaq_send_command fails during a device reset, init_card frees the snd_card structure while a URB is still queued, causing usb_free_urb to dereference freed memory. A KASAN trace shows the crash, indicating a kernel panic or memory corruption.

Affected Systems

All Linux kernel users running the ALSA caiaq USB audio driver are affected. The issue exists in any kernel version prior to the patch that decouples the ep1_in_urb from the device structure. No specific versions are listed, so any kernel containing the caiaq driver may be vulnerable.

Risk and Exploitability

The CVSS score and EPSS are not provided, and the vulnerability is not listed in the CISA KEV catalog. However, the bug can crash the kernel and potentially allow an attacker with physical USB access to an audio device to trigger it, leading to privilege escalation. The likely attack vector requires a malicious or malfunctioning USB caiaq device and local control of that device.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`523f1dce37434a9a6623bf46e7893e2b4b10ac3c`	affected	< d6dd3c915b0d02457711d8fbaa60efc52144557f
`523f1dce37434a9a6623bf46e7893e2b4b10ac3c`	affected	< 0c1b907d5db2f3508375776e5b78d69591aa5626
`523f1dce37434a9a6623bf46e7893e2b4b10ac3c`	affected	< d41e6c1533f09b27fc562260d41417490d2b6084
`523f1dce37434a9a6623bf46e7893e2b4b10ac3c`	affected	< 402a9d6aab7ac787ab075adeb562c3db8b8f564b

Linux

affected

Version	Status	Constraints
`2.6.22`	affected	—
`0`	unaffected	< 2.6.22
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3-rc3`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that contains the ALSA caiaq fix.
If a kernel update is unavailable, block or disable the caiaq USB audio device by creating a udev rule that denies access to the device or unloading the snd_usb_caiaq module.
Monitor system logs for KASAN errors and ensure that no use‑after‑free events occur.

Generated by OpenCVE AI on September 25, 2026 at 15:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c1b907d5db2f3508375776e5b78d69591aa5626
https://git.kernel.org/stable/c/402a9d6aab7ac787ab075adeb562c3db8b8f564b
https://git.kernel.org/stable/c/d41e6c1533f09b27fc562260d41417490d2b6084
https://git.kernel.org/stable/c/d6dd3c915b0d02457711d8fbaa60efc52144557f

History

Fri, 25 Sep 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev The epq_in_urb object belonging to the caiaq device is coupled within the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL) executes successfully, epq_in_urb is successfully added to the urbp_list queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD layer driver for the caiaq USB device). When init_card() calls snd_usb_caiaq_send_command() which subsequently fails due to a timeout, and proceeds to call snd_card_free() to release the card, the embedded ep1_in_urb object is also freed. When the dummy HCD driver detects that the URB has been unlinked, it returns the URB (by usb_hcd_giveback_urb()), which triggers [1]. Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch to using a pointer instead. Separately allocate and manage the memory for ep1_in_urb to prevent the release of the snd_card memory object from interfering with it. midi_out_urb has the same issue as ep1_in_urb and is handled in the same way. [1] BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 Call Trace: usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2067 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 Allocated by task 36: snd_card_new+0x7b/0x110 sound/core/init.c:184 create_card sound/usb/caiaq/device.c:429 [inline] snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 Freed by task 36: snd_card_free_when_closed sound/core/init.c:630 [inline] snd_card_free+0x138/0x1d0 sound/core/init.c:662 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
Title		ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c1b907d5db2f3508375776e5b78d69591aa5626 https://git.kernel.org/stable/c/402a9d6aab7ac787ab075adeb562c3db8b8f564b https://git.kernel.org/stable/c/d41e6c1533f09b27fc562260d41417490d2b6084 https://git.kernel.org/stable/c/d6dd3c915b0d02457711d8fbaa60efc52144557f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:23:32.334Z

Updated: 2026-09-25T10:23:32.334Z

Reserved: 2026-09-25T10:19:56.068Z

Link: CVE-2026-98006

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:28.847

Modified: 2026-09-25T11:17:28.847

Link: CVE-2026-98006

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T15:30:06Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object