CVE-2026-98006: ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: Decoupling ep1inurb in caiaq dev
The epqinurb object belonging to the caiaq device is coupled within the struct sndusbcaiaqdev. After usbsubmiturb(epqinurb, GFPKERNEL) executes successfully, epqinurb is successfully added to the urbplist queue of the dummy HCD driver (userspace specifies dummyhcd as the HCD layer driver for the caiaq USB device).
When initcard() calls sndusbcaiaqsendcommand() which subsequently fails due to a timeout, and proceeds to call sndcardfree() to release the card, the embedded ep1inurb object is also freed. When the dummy HCD driver detects that the URB has been unlinked, it returns the URB (by usbhcdgivebackurb()), which triggers [1].
Decouple the ep1inurb object from the struct sndusbcaiaqdev and switch to using a pointer instead. Separately allocate and manage the memory for ep1inurb to prevent the release of the sndcard memory object from interfering with it.
midiouturb has the same issue as ep1inurb and is handled in the same way.
[1] BUG: KASAN: slab-use-after-free in usbfreeurb+0x24/0x120 drivers/usb/core/urb.c:96 Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 Call Trace: usbfreeurb+0x24/0x120 drivers/usb/core/urb.c:96 dummytimer+0xaac/0x4d50 drivers/usb/gadget/udc/dummyhcd.c:2019 runhrtimer kernel/time/hrtimer.c:2067 [inline] hrtimerrunqueues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 hrtimerrunsoftirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
Allocated by task 36: sndcardnew+0x7b/0x110 sound/core/init.c:184 createcard sound/usb/caiaq/device.c:429 [inline] sndprobe+0x236/0x1af0 sound/usb/caiaq/device.c:544
Freed by task 36: sndcardfreewhenclosed sound/core/init.c:630 [inline] sndcardfree+0x138/0x1d0 sound/core/init.c:662 sndprobe+0x162b/0x1af0 sound/usb/caiaq/device.c:553
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The failure path requires a caiaq USB device using the dummy HCD driver, with an input URB successfully submitted before command initialization later fails due to a timeout. Releasing the sound card then frees the embedded URB while the dummy HCD can still return it.
What is the observable impact if the affected path is reached?
The kernel can hit a slab use-after-free when the USB HCD gives back an unlinked URB after the associated sound-card memory has been released. The report identifies both ep1_in_urb and midi_out_urb as affected by this lifetime-management issue.
What does the fix change?
The fix decouples ep1_in_urb and midi_out_urb from the snd_usb_caiaqdev structure. They are separately allocated and managed so freeing the sound card does not free URB memory that may still be returned by the USB HCD.