Executive brief
A vulnerability was identified in the Linux kernel's audio driver for Native Instruments USB audio devices. When the system fails to initialize the audio card, it may fail to properly clean up internal communication requests, leading to a resource leak. While this primarily affects system stability and memory management, it could potentially be used to cause a denial-of-service condition over time.
Technical details
A resource leak vulnerability exists in the ALSA caiaq driver (sound/usb/caiaq/device.c) within the Linux kernel. The issue stems from an incomplete error handling path in the init_card() function; specifically, if setup_card() returns an error, the driver fails to kill the previously submitted internal USB Request Block (URB) 'cdev->ep1_in_urb'. This results in a leftover URB that is normally only terminated during device disconnection. An attacker with local access could potentially trigger this error path to cause a kernel resource leak. The vulnerability has been patched by ensuring the URB is killed during the error handling sequence.
Affected products
- Linux Linux Kernel 6.1.y, 6.6.y, 6.8.y, 6.9.y
Timeline
- 2026-04-27: patched: Initial patch by Takashi Iwai
- 2026-05-27: disclosed: CVE-2026-45992 published
References
- https://git.kernel.org/stable/c/0a7b5221b5b51cc798fcfc3be00d02eade149d69
- https://git.kernel.org/stable/c/1d160e30aa42b7c41163e51366bb34432367260d
- https://git.kernel.org/stable/c/438ab932dc6fef5b001dfeba08a18a491edc8f7b
- https://git.kernel.org/stable/c/be62c8bb03b6aec3790a943d4a7567d4d73b8be9
- https://git.kernel.org/stable/c/e0fb842af7052f0ab9e709db0c59300aa4051fc0