CVE-2026-98006

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

The epq_in_urb object belonging to the caiaq device is coupled within

the struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)

executes successfully, epq_in_urb is successfully added to the urbp_list

queue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD

layer driver for the caiaq USB device).

When init_card() calls snd_usb_caiaq_send_command() which subsequently

fails due to a timeout, and proceeds to call snd_card_free() to release

the card, the embedded ep1_in_urb object is also freed. When the dummy

HCD driver detects that the URB has been unlinked, it returns the URB

(by usb_hcd_giveback_urb()), which triggers [1].

Decouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch

to using a pointer instead. Separately allocate and manage the memory for

ep1_in_urb to prevent the release of the snd_card memory object from

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References