CVE-2026-31701: ALSA: caiaq: take a reference on the USB device in create_card()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: take a reference on the USB device in createcard()
The caiaq driver stores a pointer to the parent USB device in cdev->chip.dev but never takes a reference on it. The card's privatefree callback, sndusbcaiaqcardfree(), can run asynchronously via sndcardfreewhenclosed() after the USB device has already been disconnected and freed, so any access to cdev->chip.dev in that path dereferences a freed usbdevice.
On top of the refcounting issue, the current cardfree implementation calls usbresetdevice(cdev->chip.dev). A reset in a free callback is inappropriate: the device is going away, the call takes the device lock in a teardown context, and the reset races with the disconnect path that the callback is already cleaning up after.
Take a reference on the USB device in createcard() with usbgetdev(), drop it with usbputdev() in the free callback, and remove the usbresetdevice() call.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the caiaq driver: in create_card() call usb_get_dev() to take a reference on the parent USB device and store the referenced pointer in cdev->chip.dev; in the card private_free callback snd_usb_caiaq_card_free() call usb_put_dev() to drop that reference; and remove the usb_reset_device(cdev->chip.dev) call from the free callback to avoid resetting a device that is being torn down.
ALSA caiaq driver (Linux kernel) usb_device_reference_management = take reference with usb_get_dev() in create_card(); drop reference with usb_put_dev() in snd_usb_caiaq_card_free(); remove call to usb_reset_device() from the free callback
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31701?
CVE-2026-31701 is classified as a low-severity vulnerability that affects the ALSA caiaq driver in the Linux kernel.
How do I fix CVE-2026-31701?
To fix CVE-2026-31701, update the Linux kernel to a version where the ALSA caiaq driver has been patched.
What is the impact of CVE-2026-31701?
The impact of CVE-2026-31701 includes potential resource leaks related to USB device references if the caiaq driver is in use.
Which software is affected by CVE-2026-31701?
CVE-2026-31701 affects the ALSA caiaq driver within the Linux kernel.
Is CVE-2026-31701 actively exploited?
As of the latest information, there are no known active exploits for CVE-2026-31701.