CVE-2026-31701

What it actually does

This is a Linux kernel use-after-free in the ALSA caiaq USB audio driver. The driver stores a pointer to the parent USB device without incrementing the USB device reference count. If the caiaq-backed sound card is freed asynchronously after the USB device has already been disconnected and released, the cleanup path can dereference freed kernel memory. The affected cleanup path also attempted to reset the USB device during teardown, which can race with disconnect handling and worsen instability. The practical impact is local kernel crash or system hang, causing denial of service; the published CVSS vector indicates local access is required and does not indicate direct confidentiality or integrity impact.

Why it matters to the business

Systems using affected Linux kernels with the ALSA caiaq driver enabled may be vulnerable to local denial of service when compatible USB audio hardware is connected, disconnected, or manipulated. The most likely operational consequence is an unexpected kernel panic, reboot, or audio/USB subsystem instability on workstations, audio production systems, kiosks, or specialized Linux endpoints. EPSS is very low and there is no known KEV listing or ransomware association, so broad internet-scale exploitation is unlikely; however, organizations with untrusted local users or exposed physical USB access should still treat this as a reliability and local-abuse risk.

How an attack unfolds

An attacker needs local access to a vulnerable Linux system and a way to trigger the affected caiaq USB audio driver path, typically by using compatible USB audio hardware or emulated USB device behavior. The attacker causes the driver to create an ALSA sound card object, keeps file descriptors or references open so the card free operation can be deferred, and then triggers USB disconnect or teardown. Because the driver did not hold a reference to the USB device, the deferred free callback may later access a USB device object that has already been freed. That stale pointer dereference can crash the kernel or deadlock/race during teardown, producing a local denial of service.

How to fix it

Upgrade to a Linux kernel build from the operating system or appliance vendor that includes the ALSA caiaq fix: the driver must take a USB device reference with usb_get_dev() during card creation, release it with usb_put_dev() during cleanup, and avoid usb_reset_device() in the free callback. No exact fixed kernel versions were provided in the input, so use vendor advisories and package changelogs to identify the first fixed kernel for each distribution. Where immediate patching is not possible, mitigate by disabling or blacklisting the caiaq driver if not required, restricting physical USB access, blocking untrusted USB devices, and limiting local shell access on systems where kernel availability is critical.

How to confirm the fix worked

Confirm remediation by verifying the running kernel package is at or above the vendor-fixed version and that the vendor changelog references the ALSA caiaq USB device reference-counting fix. If building from source, confirm the caiaq driver code takes a USB device reference in card creation, releases it in the card free path, and no longer calls usb_reset_device() from the free callback. Also validate exposure by checking whether the caiaq module is present or loaded, whether compatible USB audio devices are used, and whether systems generate kernel warnings or crashes during USB audio disconnect testing. A patched system should tolerate connect/disconnect cycles of supported USB audio devices without kernel oops, KASAN use-after-free reports, or panic events.

Typical attack path

1. Gain local interactive access, physical USB access, or control over a connected/emulated USB device on a vulnerable Linux system.
2. Attach or emulate a caiaq-supported USB audio device so the ALSA caiaq driver creates a sound card instance.
3. Open or otherwise hold references to the ALSA sound device so cleanup can be deferred after disconnect.
4. Trigger device disconnect, reset, or teardown while the ALSA card object remains pending cleanup.
5. Cause the deferred card free callback to access the already-freed USB device pointer.
6. Induce a kernel oops, panic, hang, or forced reboot, resulting in denial of service.

How to detect it

Look for signs of local denial-of-service activity rather than remote compromise. Relevant sources include kernel logs, system journal, crash dumps, kdump/vmcore records, USB subsystem logs, ALSA logs, endpoint telemetry for module loading, and unexpected reboot records. Correlate crashes or hangs with USB audio device insertion/removal, loading of the caiaq driver, ALSA sound card teardown, KASAN use-after-free reports, kernel oops traces, or panic messages. Because no public exploit indicators or threat actor activity are known from the provided data, detection should focus on behavioral evidence: repeated connect/disconnect events for USB audio devices followed by kernel faults, local users interacting with ALSA device nodes shortly before a crash, and systems rebooting unexpectedly after caiaq-related log entries.

• snd_usb_caiaq
• caiaq
• ALSA: caiaq
• usb_reset_device
• KASAN: use-after-free
• BUG: KASAN: use-after-free
• kernel BUG
• Oops:
• general protection fault
• unable to handle kernel NULL pointer dereference
• snd_usb_caiaq_card_free
• snd_card_free_when_closed
• usb_disconnect
• USB disconnect
• new full-speed USB device
• new high-speed USB device
• Kernel panic - not syncing
• watchdog: BUG: soft lockup
• watchdog: BUG: hard LOCKUP
• module snd_usb_caiaq
• /sys/module/snd_usb_caiaq
• /dev/snd/

What your security team should do

• Prioritize patching Linux endpoints and appliances that allow local users, physical USB access, or untrusted peripheral attachment.
• Inventory systems with the caiaq driver available or loaded, especially workstations and specialized audio systems.
• If the driver is not needed, blacklist or disable the caiaq module as a compensating control until kernels are updated.
• Restrict physical USB access and enforce USB device control policies on sensitive Linux systems.
• Monitor kernel logs for USB, ALSA, caiaq, KASAN, oops, panic, or unexpected reboot events that coincide with USB audio connect/disconnect activity.
• Because EPSS is low, not KEV-listed, and has no known exploit maturity, handle through normal kernel patch cycles unless local-user or physical-access threat is elevated.