CVE-2026-98066: ALSA: caiaq: Fix potential double-free at error path
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: Fix potential double-free at error path
The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch suggested, some of the audio resources such as URBs have been already freed, and this may lead to a double-free.
For addressing the double-free, call the common destructor function from each place, and assure that the resource pointers get cleared.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the ALSA caiaq driver error paths, release resources through the common destructor function and clear resource pointers after resources such as URBs are freed to prevent double-free.
Event History
Frequently Asked Questions
Which systems should be assessed for exposure?
Systems using the Linux ALSA caiaq driver should be assessed. The issue is specific to that driver’s audio resource cleanup handling.
Under what conditions can the issue occur?
The problem is in an error-handling path where some audio resources, including URBs, may already have been freed before a common destructor runs. Releasing those resources again can result in a double-free.