{"id":"CVE-2026-98837","kind":"vulnerability","aliases":["CVE-2026-98837"],"related":[],"title":"Linux kernel: failed caiaq USB audio probe leaves freed-memory read","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: unregister the input device when probe fails\n\nsetup_card() registers the input device, whose name and phys point into\nstruct snd_usb_caiaqdev, and then goes on to snd_card_register() and\nsnd_usb_caiaq_control_init(). If either fails, snd_probe() calls\nsnd_card_free(), which frees the device state but leaves the input\ndevice registered: card_free() only clears the pointer, and the input\ndevice is unregistered from snd_disconnect() alone. Reading its \"uevent\"\nattribute afterwards dereferences freed memory:\n\n  BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0\n  Read of size 1 at addr ffff8880208f5043 by task caiaq/4967\n   add_uevent_var+0x183/0x3a0\n   input_dev_uevent+0x162/0x900\n   dev_uevent+0x2f1/0x870\n   uevent_show+0x1ca/0x3a0\n   ...\n\nUnregister the input device on the probe error path, as\nsnd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when\nno input device was registered.\n\nReproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that\nmakes snd_usb_caiaq_control_init() fail.","summary":"When the ALSA caiaq USB audio driver fails during probe, it frees device state but leaves its input device registered. Reading that device's uevent attribute afterwards reads freed kernel memory, which can crash the kernel or leak data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","package","self-hosted","usb-audio"],"not_affected_if":["module-not-loaded","no-caiaq-hardware"],"how_to_check":"- unknown","fix":"- Install a Linux kernel build that includes the upstream fix that unregisters the input device on the probe error path in sound/usb/caiaq.\n- unknown","status":"open","published_at":"2026-10-18T16:17:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:14+00:00","updated_at":"2026-10-25T05:13:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:13:14Z","model":"claude-haiku-5-5","output":{"fix":"- Install a Linux kernel build that includes the upstream fix that unregisters the input device on the probe error path in sound/usb/caiaq.\n- unknown","reach":"local","title":"Linux kernel: failed caiaq USB audio probe leaves freed-memory read","impact":"medium","summary":"When the ALSA caiaq USB audio driver fails during probe, it frees device state but leaves its input device registered. Reading that device's uevent attribute afterwards reads freed kernel memory, which can crash the kernel or leak data.","category":"package","nicknames":[],"who_cares":["linux-kernel","usb-audio","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"local kernel memory read after free may crash or leak data","analyst_note":"Check the kernel.org stable commit for affected and fixed version ranges and whether the caiaq module is built in distribution kernels.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-caiaq-hardware","module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the ALSA caiaq driver, used for Native Instruments Kontrol and similar USB audio controllers, are exposed. Machines without these devices or without the caiaq module loaded can skip it. The sources do not say which kernel versions are vulnerable.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000624,"input_tokens":3677,"output_tokens":512,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':170C,185C,190C,194C,198C '-2026':14A,17A '-98837':15A,18A '1':175C,237C 'add':182C 'addr':177C 'afterward':55B,157C 'alon':152C 'alsa':31B,78C 'attribut':54B,156C 'audio':6A,28B,34B,235C 'bug':161C 'caiaq':4A,32B,79C,114C,215C,246C 'caiaq/4967':181C 'caiaqdev':102C 'call':122C 'card':88C,109C,124C,137C 'clear':140C 'control':115C,247C 'crash':62B 'cve':13A,16A 'data':67B 'derefer':158C 'dev':188C,192C 'devic':41B,47B,51B,83C,92C,129C,135C,146C,203C,226C 'disconnect':151C,211C,217C 'driver':35B 'either':118C 'error':207C 'fail':3A,36B,86C,119C,249C 'ffff8880208f5043':178C 'follow':73C 'free':40B,125C,127C,138C,167C 'freed':10A,57B,159C 'freed-memori':9A 'gadget':234C 'goe':105C 'hack':241C 'host':25B 'init':116C,248C 'input':46B,82C,91C,134C,145C,187C,202C,216C,225C 'kasan':162C 'kernel':2A,21B,58B,64B,71C 'kontrol':236C 'leak':66B 'leav':8A,44B,132C 'linux':1A,20B,70C 'linux-kernel':19B 'make':243C 'memori':11A,59B,160C 'name':94C 'no-op':220C 'op':222C 'packag':22B 'path':208C 'phys':96C 'point':97C 'pointer':142C 'probe':7A,38B,85C,121C,206C 'raw':233C 'raw-gadget':232C 'read':12A,49B,56B,153C,172C 'regist':48B,89C,110C,136C,228C 'reproduc':229C 'resolv':77C 'self':24B 'self-host':23B 'setup':87C 'show':197C 'size':174C 'slab':164C 'slab-use-after-fre':163C 'snd':100C,108C,112C,120C,123C,150C,210C,213C,244C 'state':42B,130C 'string':169C 'struct':99C 'task':180C 'temporari':240C 'uevent':53B,155C,183C,189C,193C,196C 'unregist':80C,148C,200C 'usb':5A,27B,33B,101C,113C,214C,245C 'usb-audio':26B 'use':165C 'var':184C 'vulner':74C 'whose':93C 'x162/0x900':191C 'x183/0x3a0':186C 'x1ca/0x3a0':199C 'x2f1/0x870':195C 'x4a9/0x4f0':171C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the ALSA caiaq driver, used for Native Instruments Kontrol and similar USB audio controllers, are exposed. Machines without these devices or without the caiaq module loaded can skip it. The sources do not say which kernel versions are vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98837","severity":null,"published_at":"2026-10-18T16:17:37+00:00","modified_at":"2026-10-21T13:21:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}