Junglewise Threat Intelligence

CVE-2026-31778: Linux Kernel ALSA caiaq stack out-of-bounds read in init_card

CVE-2026-31778 · Severity: high · CVSS 7.1 · Published 2026-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's audio driver for certain USB devices could allow an attacker to read sensitive information from the system's memory. By connecting a specially crafted USB device with a long product name, an attacker can trigger a memory error that exposes internal system data. This could lead to the theft of sensitive information or cause the system to crash.

Technical details

A stack-based out-of-bounds read exists in the init_card function within sound/usb/caiaq/device.c. The vulnerability is caused by an off-by-one error in a whitespace-stripping loop where the bounds check `len < sizeof(card->id)` fails to account for the null terminator. If a USB device provides a product name with 16 or more non-space characters, the local 16-byte buffer is filled without a null terminator. Subsequent calls to snd_card_set_id() and copy_valid_id_string() perform string operations that scan past the buffer end, leading to a KASAN-detected stack-out-of-bounds read. This allows a local attacker or someone with physical access to a USB port to leak kernel stack contents. The issue has been patched by adjusting the loop bound to `sizeof(card->id) - 1`.

Affected products

  • Linux Linux Kernel 2.6.31 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.134, 6.7 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6

Timeline

  • 2009-06-01: other: Vulnerability introduced in commit bafeee5b1f8d
  • 2026-03-29: other: Vulnerability reported by Berk Cem Goksel
  • 2026-04-18: patched: Fix committed to stable kernel trees
  • 2026-05-01: disclosed: CVE-2026-31778 published

References

Related threats