Medium 5.5Published May 1, 2026

CVE-2026-31701ALSA: caiaq: take a reference on the USB device in create_card()

Updated under an hour ago (Oct 27, 2026, 5:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: take a reference on the USB device in create_card() The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's private_free callback, snd_usb_caiaq_card_free(), can run asynchronously via snd_card_free_when_closed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usb_device. On top of the refcounting issue, the current card_free implementation calls usb_reset_device(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after. Take a reference on the USB device in create_card() with usb_get_dev(), drop it with usb_put_dev() in the free callback, and remove the usb_reset_device() call.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4dd821dcbfcecf7af6a08370b0b217cde2818acf before 493b3a682ededc804555755f5d2193201339612d; from cadf1d8e9ddcd74584ec961aeac14ac549b261d8 before dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e; from 237f3faf0177bdde728fa3106d730d806436aa4d before ac7345f68cda6989016d85d63f7b244c064aa8f6; from 4507a8b9b30344c5ddd8219945f446d47e966a6d before f6634af5de728a46792f674a66d7843570cb68f7; from a3f9314752dbb6f6aa1f0f2b4c58243bda800738 before 1d9be95aee6c6246a21752e60c9519902649f482; from b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c before 6473ed16df1fe88051140611b3eb9a49be7f429e; from b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c before 59b622a043cffc58b7638cd85ae6c30a0904f8e6; from b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c before 80bb50e2d459213cccff3111d5ef98ed4238c0d5; and 11 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 6.13 before 6.18.25; from 6.19 before 7.0.2; 6.13; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/493b3a682ededc804555755f5d2193201339612d
https://git.kernel.org/stable/c/dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e
https://git.kernel.org/stable/c/ac7345f68cda6989016d85d63f7b244c064aa8f6
https://git.kernel.org/stable/c/f6634af5de728a46792f674a66d7843570cb68f7	patch
https://git.kernel.org/stable/c/1d9be95aee6c6246a21752e60c9519902649f482	patch
https://git.kernel.org/stable/c/6473ed16df1fe88051140611b3eb9a49be7f429e	patch
https://git.kernel.org/stable/c/59b622a043cffc58b7638cd85ae6c30a0904f8e6	patch
https://git.kernel.org/stable/c/80bb50e2d459213cccff3111d5ef98ed4238c0d5	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.