Not yet scoredPublished Oct 18, 2026

CVE-2026-98837ALSA: caiaq: unregister the input device when probe fails

Updated under an hour ago (Oct 28, 2026, 1:23 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setup_card() registers the input device, whose name and phys point into struct snd_usb_caiaqdev, and then goes on to snd_card_register() and snd_usb_caiaq_control_init(). If either fails, snd_probe() calls snd_card_free(), which frees the device state but leaves the input device registered: card_free() only clears the pointer, and the input device is unregistered from snd_disconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory: BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 add_uevent_var+0x183/0x3a0 input_dev_uevent+0x162/0x900 dev_uevent+0x2f1/0x870 uevent_show+0x1ca/0x3a0 ... Unregister the input device on the probe error path, as snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when no input device was registered. Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes snd_usb_caiaq_control_init() fail.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 18, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f537e3ad69609f6924a4db6b4a7f6561f5288bdd before df2787819bd137111b56b8631dd581b0cce7144d; from 6251e3e256337a30160ef59ab1580dde4d1acd28 before 850810c12686f80cdf7530f4f21e0157d904f739; from e59ecd4ee3a450db6cb4e4ecaa3efdd593f80056 before 84727facd8506140cd04f2b0a8b1c4ddeac41cea; 28abd224db4a49560b452115bca3672a20e45b2f builds before 2e5a413cc2a489c9427ecd3d73ad764bfb0c7103; 28abd224db4a49560b452115bca3672a20e45b2f builds before 0b7bd20f6379bc5e431fd74d866390f5b5b63f3c; da938aa9fc7826901921dcea225948ab21a97e45; 09616e25f502080ba684fc7fcf959d1376ab756d; b956e48371f2ff72b76be9a829800ecec963bd45; and 8 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/df2787819bd137111b56b8631dd581b0cce7144d
https://git.kernel.org/stable/c/850810c12686f80cdf7530f4f21e0157d904f739
https://git.kernel.org/stable/c/84727facd8506140cd04f2b0a8b1c4ddeac41cea
https://git.kernel.org/stable/c/2e5a413cc2a489c9427ecd3d73ad764bfb0c7103
https://git.kernel.org/stable/c/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.