CVE-2026-98837: ALSA: caiaq: unregister the input device when probe fails
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: unregister the input device when probe fails
setupcard() registers the input device, whose name and phys point into struct sndusbcaiaqdev, and then goes on to sndcardregister() and sndusbcaiaqcontrolinit(). If either fails, sndprobe() calls sndcardfree(), which frees the device state but leaves the input device registered: cardfree() only clears the pointer, and the input device is unregistered from snddisconnect() alone. Reading its "uevent" attribute afterwards dereferences freed memory:
BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0 Read of size 1 at addr ffff8880208f5043 by task caiaq/4967 addueventvar+0x183/0x3a0 inputdevuevent+0x162/0x900 devuevent+0x2f1/0x870 ueventshow+0x1ca/0x3a0 ...
Unregister the input device on the probe error path, as snddisconnect() does. sndusbcaiaqinputdisconnect() is a no-op when no input device was registered.
Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that makes sndusbcaiaqcontrolinit() fail.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure the ALSA caiaq driver unregisters the input device on the probe error path when snd_usb_caiaq_control_init() or setup_card() fails, preventing use-after-free during subsequent uevent handling.