Executive brief
A vulnerability was identified in the Linux kernel's ALSA (Advanced Linux Sound Architecture) driver for caiaq USB audio devices. When a specially crafted or malfunctioning USB audio device is plugged into the system, the driver may fail to properly release system memory during the initial connection process. This leads to a memory leak that could eventually degrade system performance or cause a crash if triggered repeatedly.
Technical details
A reference count leak exists in the ALSA caiaq driver (sound/usb/caiaq/device.c) due to improper cleanup during probe failure. The function create_card() increments the USB device reference count via usb_get_dev(), but the corresponding cleanup destructor (card_free) is only assigned to the snd_card's ->private_free pointer late in the init_card() sequence. If a failure occurs during init_card()—such as a timeout or an error in usb_set_interface()—the driver calls snd_card_free(), which fails to execute the destructor because the pointer is still NULL. This results in a leak of the struct usb_device and associated descriptor allocations. The fix moves the destructor assignment immediately after the reference is taken.
Affected products
- Linux Linux Kernel Fixed in 21ca595, 50c6a1f, 6153878, 7a5f1cd, da3b8fd
Timeline
- 2026-04-26: patched: Initial patch submitted by Deepanshu Kartikey
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/21ca595aafa40d3ac70eab1f4cb62cc00ca21657
- https://git.kernel.org/stable/c/50c6a1f05973f56d23280c9d7645a7a5734e0907
- https://git.kernel.org/stable/c/6153878c5255bb69b7d0868105ca078ef13cbcf8
- https://git.kernel.org/stable/c/7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b
- https://git.kernel.org/stable/c/da3b8fd6a202d94fef11a443abc9171c52426a1c