CVE-2026-98837

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: caiaq: unregister the input device when probe fails

setup_card() registers the input device, whose name and phys point into

struct snd_usb_caiaqdev, and then goes on to snd_card_register() and

snd_usb_caiaq_control_init(). If either fails, snd_probe() calls

snd_card_free(), which frees the device state but leaves the input

device registered: card_free() only clears the pointer, and the input

device is unregistered from snd_disconnect() alone. Reading its "uevent"

attribute afterwards dereferences freed memory:

BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0

Read of size 1 at addr ffff8880208f5043 by task caiaq/4967

add_uevent_var+0x183/0x3a0

input_dev_uevent+0x162/0x900

dev_uevent+0x2f1/0x870

uevent_show+0x1ca/0x3a0

...

Unregister the input device on the probe error path, as

snd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when

no input device was registered.

Reprod

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References