Junglewise Threat Intelligence

CVE-2026-31701: Linux Kernel ALSA caiaq use-after-free in USB device disconnection

CVE-2026-31701 · Severity: medium · CVSS 5.5 · Published 2026-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's ALSA caiaq driver, which handles certain USB audio devices. A flaw in how the driver manages memory when a device is disconnected could allow a local user to cause a system crash (denial of service). This occurs because the system may attempt to access memory associated with the USB device after it has already been released.

Technical details

A use-after-free vulnerability exists in the ALSA caiaq driver (sound/usb/caiaq/device.c) within the Linux kernel. The driver fails to take a proper reference on the parent USB device in create_card(), leading to a race condition where the snd_usb_caiaq_card_free() callback may dereference a freed usb_device structure if the device is disconnected while the card is still being closed. Additionally, the driver inappropriately called usb_reset_device() during the teardown path, further complicating the race condition. The fix involves implementing proper reference counting using usb_get_dev() and usb_put_dev() and removing the improper reset call.

Affected products

  • Linux Linux Kernel 6.13 to 6.18.25, 6.19 to 7.0.2

Timeline

  • 2026-04-13: patched: Initial patch submitted by Berk Cem Goksel
  • 2026-05-01: disclosed: CVE published by kernel.org
  • 2026-05-01: advisory

References

Related threats