Executive brief
A vulnerability was identified in the Linux kernel's ALSA (Advanced Linux Sound Architecture) driver for caiaq USB audio devices. The driver failed to properly handle errors during the device initialization process, which could lead to a 'use-after-free' condition where the system attempts to access memory that has already been released. This could potentially result in a system crash or allow for local privilege escalation.
Technical details
A use-after-free (UAF) vulnerability exists in the sound/usb/caiaq/device.c component of the Linux kernel. The setup_card() function was originally defined as a void function and did not gracefully handle errors from internal calls such as snd_card_register(). If snd_card_register() failed, it would call snd_card_free() but continue execution, leading to a UAF when subsequent functions like snd_usb_caiaq_control_init() were called. The fix involves refactoring setup_card() to return error codes and ensuring the caller (snd_probe) handles these fatal errors by propagating them correctly. This prevents the driver from attempting to operate on a card structure that has already been freed.
Affected products
- Linux Linux Kernel 8e3cd08ed8e5
Timeline
- 2026-04-14: patched: Initial patch by Takashi Iwai
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/096dd8519cf2f768e9e14f224b627f7aaee1a9c5
- https://git.kernel.org/stable/c/28abd224db4a49560b452115bca3672a20e45b2f
- https://git.kernel.org/stable/c/6251e3e256337a30160ef59ab1580dde4d1acd28
- https://git.kernel.org/stable/c/e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056
- https://git.kernel.org/stable/c/f537e3ad69609f6924a4db6b4a7f6561f5288bdd