CVE-2026-98837
NoneCVSS
—
EPSS
0.2%
Published
Oct 18, 2026
CISA due date
—
Cloudanix analysis
A bug in how the system handles certain USB audio devices can leave behind a reference to already-freed memory, which may cause crashes or be abused if an attacker plugs in a specially made device.
- Exploitation
- Physical Access
- Attacker needs
- Physical Access
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in the Linux kernel ALSA caiaq USB audio driver: on probe failure after input device registration, snd_card_free clears device state while the input device remains registered, so subsequent uevent reads dereference freed memory.
Why it matters to the business
Kernel instability or potential privilege escalation on systems using specific USB audio interfaces; low likelihood given niche hardware and no public exploits, but requires prompt patching on affected kernels to avoid crashes during device enumeration.
How an attack unfolds
An attacker with physical or USB access crafts a device that causes snd_usb_caiaq_control_init to fail after input registration; reading the uevent sysfs attribute then triggers the slab-use-after-free, potentially allowing kernel memory corruption or information leak.
How to fix it
Apply the upstream fix that calls snd_usb_caiaq_input_disconnect on the probe error path before snd_card_free; upgrade to a kernel containing commit resolving the registration lifetime issue.
How to confirm the fix worked
Confirm kernel source contains the input device unregistration on error; test probe failure scenarios with a USB device that induces snd_usb_caiaq_control_init failure and verify no KASAN reports on uevent access.
Typical attack path
- Connect malicious or malformed USB audio device to trigger caiaq probe
- Force probe failure path after input device registration
- Trigger uevent read (e.g., via udev or sysfs access) on the dangling input device
- Exploit resulting use-after-free for memory corruption or denial of service
How to detect it
Review kernel logs for KASAN slab-use-after-free reports involving input_dev_uevent or add_uevent_var during caiaq device probe; inspect dmesg or journalctl for snd_usb_caiaq and failed snd_card_register sequences.
What your security team should do
- Prioritize kernel updates on any systems exposing ALSA caiaq drivers to untrusted USB devices
- Monitor for new kernel releases containing the caiaq probe error handling fix
- Restrict physical USB access on high-value systems until patched
The record
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory: BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add_uevent_var+0x183/0x3a0 input_dev_uevent+0x162/0x900 dev_uevent+0x2f1/0x870 uevent_show+0x1ca/0x3a0 ... Unregister the input device on the probe error path, as snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when no input device was registered. Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd_usb_caiaq_control_init() fail.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|