Executive brief
A vulnerability was identified in the Linux kernel's ALSA caiaq driver, which handles certain USB audio devices. A flaw in how the driver manages memory when a device is disconnected could allow a local user to cause a system crash (denial of service). This occurs because the system may attempt to access memory associated with the USB device after it has already been released.
Technical details
A use-after-free vulnerability exists in the ALSA caiaq driver (sound/usb/caiaq/device.c) within the Linux kernel. The driver fails to take a proper reference on the parent USB device in create_card(), leading to a race condition where the snd_usb_caiaq_card_free() callback may dereference a freed usb_device structure if the device is disconnected while the card is still being closed. Additionally, the driver inappropriately called usb_reset_device() during the teardown path, further complicating the race condition. The fix involves implementing proper reference counting using usb_get_dev() and usb_put_dev() and removing the improper reset call.
Affected products
- Linux Linux Kernel 6.13 to 6.18.25, 6.19 to 7.0.2
Timeline
- 2026-04-13: patched: Initial patch submitted by Berk Cem Goksel
- 2026-05-01: disclosed: CVE published by kernel.org
- 2026-05-01: advisory
References
- https://git.kernel.org/stable/c/1d9be95aee6c6246a21752e60c9519902649f482
- https://git.kernel.org/stable/c/493b3a682ededc804555755f5d2193201339612d
- https://git.kernel.org/stable/c/59b622a043cffc58b7638cd85ae6c30a0904f8e6
- https://git.kernel.org/stable/c/6473ed16df1fe88051140611b3eb9a49be7f429e
- https://git.kernel.org/stable/c/80bb50e2d459213cccff3111d5ef98ed4238c0d5
- https://git.kernel.org/stable/c/ac7345f68cda6989016d85d63f7b244c064aa8f6
- https://git.kernel.org/stable/c/dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e