CVE-2026-98837ALSA: caiaq: unregister the input device when probe fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory: BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add_uevent_var+0x183/0x3a0 input_dev_uevent+0x162/0x900 dev_uevent+0x2f1/0x870 uevent_show+0x1ca/0x3a0 ... Unregister the input device on the probe error path, as snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when no input device was registered. Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd_usb_caiaq_control_init() fail.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 6251e3e256337a30160ef59ab1580dde4d1acd28 before 850810c12686f80cdf7530f4f21e0157d904f739; from e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056 before 84727facd8506140cd04f2b0a8b1c4ddeac41cea; 28abd224db4a49560b452115bca3672a20e45b2f builds before 2e5a413cc2a489c9427ecd3d73ad764bfb0c7103; 28abd224db4a49560b452115bca3672a20e45b2f builds before 0b7bd20f6379bc5e431fd74d866390f5b5b63f3c; da938aa9fc7826901921dcea225948ab21a97e45; 09616e25f502080ba684fc7fcf959d1376ab756d; b956e48371f2ff72b76be9a829800ecec963bd45; f537e3ad69609f6924a4db6b4a7f6561f5288bdd; and 8 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739
- https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea
- https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103
- https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.