CVE-2026-98837 - Vulnerability Details

- ALSA: caiaq: unregister the input device when probe fails

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: unregister the input device when probe fails

setup_card() registers the input device, whose name and phys point into
struct snd_usb_caiaqdev, and then goes on to snd_card_register() and
snd_usb_caiaq_control_init(). If either fails, snd_probe() calls
snd_card_free(), which frees the device state but leaves the input
device registered: card_free() only clears the pointer, and the input
device is unregistered from snd_disconnect() alone. Reading its "uevent"
attribute afterwards dereferences freed memory:

BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0
Read of size 1 at addr ffff8880208f5043 by task caiaq/4967
add_uevent_var+0x183/0x3a0
input_dev_uevent+0x162/0x900
dev_uevent+0x2f1/0x870
uevent_show+0x1ca/0x3a0
...

Unregister the input device on the probe error path, as
snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when
no input device was registered.

Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that
makes snd_usb_caiaq_control_init() fail.

Published: 2026-10-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The ALSA caiaq driver for Linux contains a flaw where a probe failure leaves an input device registered after its underlying state has been freed. When the kernel subsequently reads that device’s uevent attribute, it dereferences freed memory, triggering a use-after-free. This results in kernel memory corruption that can lead to instability such as a crash.

Affected Systems

All Linux systems that include the ALSA caiaq driver prior to the patch are affected. This includes mainstream distributions running a standard kernel in which the caiaq driver handles USB audio devices.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate risk. Triggering the flaw requires a probe error on a USB audio device, which is inferred to be a local physical access scenario based on the reproduction with a raw-gadget Audio Kontrol 1. No public exploits are documented, the EPSS score is listed as < 1%, and the vulnerability is not in the CISA KEV catalog. Consequently, while the potential impact involves a kernel crash or instability, the likelihood of exploitation remains low at present.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`da938aa9fc7826901921dcea225948ab21a97e45`	affected	< 7017c9dda1ebbab428a6fd29c841596b5c9c84d1
`09616e25f502080ba684fc7fcf959d1376ab756d`	affected	< 8315ea07ebb2497531ff42dd640396f6f1d4a8f0
`b956e48371f2ff72b76be9a829800ecec963bd45`	affected	< 1d5d194594ff616ad36a052bde739d1cf5855b95
`f537e3ad69609f6924a4db6b4a7f6561f5288bdd`	affected	< df2787819bd137111b56b8631dd581b0cce7144d
`6251e3e256337a30160ef59ab1580dde4d1acd28`	affected	< 850810c12686f80cdf7530f4f21e0157d904f739
`e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056`	affected	< 84727facd8506140cd04f2b0a8b1c4ddeac41cea
`28abd224db4a49560b452115bca3672a20e45b2f`	affected	< 2e5a413cc2a489c9427ecd3d73ad764bfb0c7103
`28abd224db4a49560b452115bca3672a20e45b2f`	affected	< 0b7bd20f6379bc5e431fd74d866390f5b5b63f3c
`096dd8519cf2f768e9e14f224b627f7aaee1a9c5`	affected	—
`5.10.258`	affected	< 5.10.273
`5.15.209`	affected	< 5.15.224
`6.1.175`	affected	< 6.1.191
`6.6.140`	affected	< 6.6.160
`6.12.86`	affected	< 6.12.113
`6.18.27`	affected	< 6.18.56
`7.0.4`	affected	< 7.1

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6251e3e256337a30160ef59ab1580dde4d1acd28,850810c12686f80cdf7530f4f21e0157d904f739)`	affected	code_commit	—
`[e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056,84727facd8506140cd04f2b0a8b1c4ddeac41cea)`	affected	code_commit	—
`[28abd224db4a49560b452115bca3672a20e45b2f,2e5a413cc2a489c9427ecd3d73ad764bfb0c7103)`	affected	code_commit	—
`[28abd224db4a49560b452115bca3672a20e45b2f,0b7bd20f6379bc5e431fd74d866390f5b5b63f3c)`	affected	code_commit	—
`da938aa9fc7826901921dcea225948ab21a97e45`	affected	code_commit	—
`09616e25f502080ba684fc7fcf959d1376ab756d`	affected	code_commit	—
`b956e48371f2ff72b76be9a829800ecec963bd45`	affected	code_commit	—
`f537e3ad69609f6924a4db6b4a7f6561f5288bdd`	affected	code_commit	—
`096dd8519cf2f768e9e14f224b627f7aaee1a9c5`	affected	code_commit	—
`[6.12.86,6.12.113)`	affected	semver	—
`[6.18.27,6.18.56)`	affected	semver	—
`[5.10.258,5.11)`	affected	generic	—
`[5.15.209,5.16)`	affected	generic	—
`[6.1.175,6.2)`	affected	generic	—
`[6.6.140,6.7)`	affected	generic	—
`[7.0.4,7.1)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	generic	—
`[6.12.113,6.12.*]`	unaffected	generic	—
`[6.18.56,6.18.*]`	unaffected	generic	—
`[7.2.10,7.2.*]`	unaffected	generic	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the patched ALSA caiaq driver
If a kernel update is not feasible, unload or disable the caiaq module or block its activation for USB audio devices using udev rules
Monitor kernel logs for KASAN or use-after-free messages related to ALSA to detect any abnormal activity

Generated by OpenCVE AI on October 24, 2026 at 03:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98837.mbox
https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c
https://git.kernel.org/stable/c/1d5d194594ff616ad36a052bde739d1cf5855b95
https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103
https://git.kernel.org/stable/c/7017c9dda1ebbab428a6fd29c841596b5c9c84d1
https://git.kernel.org/stable/c/8315ea07ebb2497531ff42dd640396f6f1d4a8f0
https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea
https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739
https://git.kernel.org/stable/c/df2787819bd137111b56b8631dd581b0cce7144d
https://nvd.nist.gov/vuln/detail/CVE-2026-98837
https://www.cve.org/CVERecord?id=CVE-2026-98837

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1d5d194594ff616ad36a052bde739d1cf5855b95 https://git.kernel.org/stable/c/7017c9dda1ebbab428a6fd29c841596b5c9c84d1 https://git.kernel.org/stable/c/8315ea07ebb2497531ff42dd640396f6f1d4a8f0

Sat, 24 Oct 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98837.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98837 https://www.cve.org/CVERecord?id=CVE-2026-98837
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/df2787819bd137111b56b8631dd581b0cce7144d

Sun, 18 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory: BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add_uevent_var+0x183/0x3a0 input_dev_uevent+0x162/0x900 dev_uevent+0x2f1/0x870 uevent_show+0x1ca/0x3a0 ... Unregister the input device on the probe error path, as snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when no input device was registered. Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd_usb_caiaq_control_init() fail.
Title		ALSA: caiaq: unregister the input device when probe fails
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103 https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:50:05.338Z

Updated: 2026-10-30T12:40:06.606Z

Reserved: 2026-09-25T10:25:14.372Z

Link: CVE-2026-98837

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:37.943

Modified: 2026-10-30T13:21:29.920

Link: CVE-2026-98837

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98837 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T04:00:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object