CVE-2026-98066: ALSA: caiaq: Fix potential double-free at error path
Published Sep 25, 2026
·Updated
ALSA: caiaq: Fix potential double-free at error path
Affected Software
2 affected componentsFixes available
Linux ALSA caiaq driver
Microsoft azl3 kernel 6.6.157.1-1<6.6.158.1-1
6.6.158.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Compensating control
In the ALSA caiaq driver error paths, release resources through the common destructor function and clear resource pointers after resources such as URBs are freed to prevent double-free.
Event History
Sep 25, 2026
CVE Published
via MITRE·10:24 AM
Data Sourced
via MITRE·10:24 AM
Description
Data Sourced
via NVD·11:17 AM
Description
Sep 28, 2026
Data Sourced
via Microsoft·07:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which systems should be assessed for exposure?
Systems using the Linux ALSA caiaq driver should be assessed. The issue is specific to that driver’s audio resource cleanup handling.
2
Under what conditions can the issue occur?
The problem is in an error-handling path where some audio resources, including URBs, may already have been freed before a common destructor runs. Releasing those resources again can result in a double-free.