CVE-2026-98837

ALSA: caiaq: unregister the input device when probe fails

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: unregister the input device when probe fails

setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory:

BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add_uevent_var+0x183/0x3a0 input_dev_uevent+0x162/0x900 dev_uevent+0x2f1/0x870 uevent_show+0x1ca/0x3a0 ...

Unregister the input device on the probe error path, as snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when no input device was registered.

Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd_usb_caiaq_control_init() fail.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	da938aa9fc7826901921dcea225948ab21a97e45 to before 7017c9dda1ebbab428a6fd29c841596b5c9c84d1Affected 09616e25f502080ba684fc7fcf959d1376ab756d to before 8315ea07ebb2497531ff42dd640396f6f1d4a8f0Affected b956e48371f2ff72b76be9a829800ecec963bd45 to before 1d5d194594ff616ad36a052bde739d1cf5855b95Affected f537e3ad69609f6924a4db6b4a7f6561f5288bdd to before df2787819bd137111b56b8631dd581b0cce7144dAffected 6251e3e256337a30160ef59ab1580dde4d1acd28 to before 850810c12686f80cdf7530f4f21e0157d904f739Affected e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056 to before 84727facd8506140cd04f2b0a8b1c4ddeac41ceaAffected 28abd224db4a49560b452115bca3672a20e45b2f to before 2e5a413cc2a489c9427ecd3d73ad764bfb0c7103Affected 28abd224db4a49560b452115bca3672a20e45b2f to before 0b7bd20f6379bc5e431fd74d866390f5b5b63f3cAffected 096dd8519cf2f768e9e14f224b627f7aaee1a9c5Affected 5.10.258 to before 5.10.273Affected 5.15.209 to before 5.15.224Affected 6.1.175 to before 6.1.191Affected 6.6.140 to before 6.6.160Affected 6.12.86 to before 6.12.113Affected 6.18.27 to before 6.18.56Affected 7.0.4 to before 7.1Affected
LinuxLinux	7.1Affected before 7.1Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

da938aa9fc7826901921dcea225948ab21a97e45 to before 7017c9dda1ebbab428a6fd29c841596b5c9c84d1Affected
09616e25f502080ba684fc7fcf959d1376ab756d to before 8315ea07ebb2497531ff42dd640396f6f1d4a8f0Affected
b956e48371f2ff72b76be9a829800ecec963bd45 to before 1d5d194594ff616ad36a052bde739d1cf5855b95Affected
f537e3ad69609f6924a4db6b4a7f6561f5288bdd to before df2787819bd137111b56b8631dd581b0cce7144dAffected
6251e3e256337a30160ef59ab1580dde4d1acd28 to before 850810c12686f80cdf7530f4f21e0157d904f739Affected
e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056 to before 84727facd8506140cd04f2b0a8b1c4ddeac41ceaAffected
28abd224db4a49560b452115bca3672a20e45b2f to before 2e5a413cc2a489c9427ecd3d73ad764bfb0c7103Affected
28abd224db4a49560b452115bca3672a20e45b2f to before 0b7bd20f6379bc5e431fd74d866390f5b5b63f3cAffected
096dd8519cf2f768e9e14f224b627f7aaee1a9c5Affected
5.10.258 to before 5.10.273Affected
5.15.209 to before 5.15.224Affected
6.1.175 to before 6.1.191Affected
6.6.140 to before 6.6.160Affected
6.12.86 to before 6.12.113Affected
6.18.27 to before 6.18.56Affected
7.0.4 to before 7.1Affected

LinuxLinux

7.1Affected
before 7.1Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.