Live › vulnerability › CVE-2026-98837
Go to dashboardWhen the ALSA caiaq USB audio driver fails during probe, it frees device state but leaves its input device registered. Reading that device's uevent attribute afterwards reads freed kernel memory, which can crash the kernel or leak data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the ALSA caiaq driver, used for Native Instruments Kontrol and similar USB audio controllers, are exposed. Machines without these devices or without the caiaq module loaded can skip it. The sources do not say which kernel versions are vulnerable.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: unregister the input device when probe fails
setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory:
BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add_uevent_var+0x183/0x3a0 input_dev_uevent+0x162/0x900 dev_uevent+0x2f1/0x870 uevent_show+0x1ca/0x3a0 ...
Unregister the input device on the probe error path, as snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when no input device was registered.
Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd_usb_caiaq_control_init() fail.
This page as .md · .json · in your agent: get_signal("CVE-2026-98837")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.